Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
Windows detected a hard disk problem.

Windows detected a hard disk problem.


Log-Analyse und Auswertung: Windows detected a hard disk problem.

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 29.02.2012, 16:43   #1
Bianca_2202
 
Windows detected a hard disk problem. - Standard

Windows detected a hard disk problem.


Hallo,

also ich habe eine Problem... Seit gestern sagt mein PC: "Windows detected a hard disk problem" und es tut sich nichts mehr.
Ich habe hier http://www.trojaner-board.de/106078-...te-failed.html das gleich problem gefunden und hab mich mal an die genaue Vorgehensweise dort gehalten.

Folgendes kam dabei raus:

OTL

OTL EXTRAS Logfile:
Code:
ATTFilter
OTL logfile created on: 28.02.2012 20:38:45 - Run 1
OTL by OldTimer - Version 3.2.33.2     Folder = C:\Users\Bianca\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,12 Gb Total Physical Memory | 1,61 Gb Available Physical Memory | 51,70% Memory free
6,48 Gb Paging File | 5,02 Gb Available in Paging File | 77,50% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,09 Gb Total Space | 35,41 Gb Free Space | 24,58% Space Free | Partition Type: NTFS
Drive D: | 144,00 Gb Total Space | 143,91 Gb Free Space | 99,94% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: BIANCA-PC | User Name: Bianca | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.02.28 20:37:08 | 000,583,680 | ---- | M] (OldTimer Tools) -- C:\Users\Bianca\Downloads\OTL.exe
PRC - [2012.01.13 14:53:16 | 000,981,680 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbam.exe
PRC - [2011.07.04 17:57:22 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.04.29 11:36:50 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.04.21 16:02:30 | 000,634,648 | ---- | M] (Microsoft Corporation) -- C:\Programme\Internet Explorer\iexplore.exe
PRC - [2010.12.10 17:30:50 | 000,086,880 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
PRC - [2010.12.10 17:29:30 | 000,238,944 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe
PRC - [2010.11.26 10:16:12 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe
PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.07.01 21:03:59 | 000,386,480 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Java\jre6\bin\jucheck.exe
PRC - [2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2008.10.25 11:44:34 | 000,031,072 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe
PRC - [2008.10.08 01:19:12 | 000,565,248 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
PRC - [2008.10.06 10:07:26 | 000,679,936 | ---- | M] (SAMSUNG Electronics) -- C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe
PRC - [2008.08.26 01:59:54 | 000,045,056 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Programme\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
PRC - [2008.08.07 03:55:38 | 000,352,256 | ---- | M] (SAMSUNG Electronics co., LTD.) -- C:\Programme\Samsung\EBM\EasyBatteryMgr3.exe
PRC - [2008.07.08 03:27:50 | 006,273,568 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2008.02.12 05:19:52 | 000,723,496 | ---- | M] (Broadcom Corporation.) -- C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe
PRC - [2008.01.21 03:24:13 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2008.01.21 03:23:33 | 000,192,000 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wsqmcons.exe
PRC - [2008.01.21 03:23:32 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Defender\MSASCui.exe
PRC - [2008.01.21 03:23:32 | 000,319,544 | ---- | M] (Microsoft Corporation) -- c:\Programme\Windows Defender\MpCmdRun.exe
PRC - [2008.01.21 03:23:29 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2008.01.16 09:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.11.01 23:26:32 | 000,087,912 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.11.01 23:26:12 | 001,242,472 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.06.29 19:32:42 | 011,800,576 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\b97f5e82d691420aa6d068a4a5d78bde\System.Web.ni.dll
MOD - [2011.06.29 19:32:31 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\1ba19f8efcff8ad7f972aa38ab9a15f5\System.Runtime.Remoting.ni.dll
MOD - [2011.06.29 17:31:43 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\381fb23cb39e1a61e13b8770eb9800ba\System.Windows.Forms.ni.dll
MOD - [2011.06.29 17:31:31 | 001,587,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\f1aa2385c0109f3059e0e6ba8b58ff68\System.Drawing.ni.dll
MOD - [2011.06.29 17:30:02 | 007,950,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dff86a62a525ec8dc827fe9f50298b7\System.ni.dll
MOD - [2011.06.29 17:25:24 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\0309936a8e1672d39b9cf14463ce69f9\mscorlib.ni.dll
MOD - [2008.12.10 03:54:50 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3184.27483__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2008.12.10 03:54:50 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3184.27484__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2008.12.10 03:54:50 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3184.27510__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2008.12.10 03:54:44 | 000,106,496 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3219.37076__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2008.12.10 03:54:44 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3219.37072__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2008.12.10 03:54:44 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3184.27493__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2008.12.10 03:54:44 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3184.27510__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2008.12.10 03:54:43 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3219.37075__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2008.10.25 03:13:02 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
MOD - [2008.07.27 19:03:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2008.07.27 19:03:08 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.resources\2.0.0.0_de_b77a5c561934e089\System.resources.dll
MOD - [2008.07.27 19:03:08 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll
MOD - [2007.08.14 05:59:54 | 006,365,184 | ---- | M] () -- C:\Programme\Common Files\LightScribe\QtGui4.dll
MOD - [2007.07.12 05:55:52 | 000,131,072 | ---- | M] () -- C:\Programme\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
MOD - [2007.07.12 05:55:28 | 001,581,056 | ---- | M] () -- C:\Programme\Common Files\LightScribe\QtCore4.dll
MOD - [2006.08.12 04:48:40 | 000,049,152 | ---- | M] () -- C:\Programme\Samsung\Samsung Magic Doctor\HookDllPS2.dll
MOD - [2006.08.12 04:48:40 | 000,049,152 | ---- | M] () -- C:\Programme\Samsung\EasySpeedUpManager\HookDllPS2.dll
MOD - [2006.08.12 04:48:40 | 000,049,152 | ---- | M] () -- C:\Programme\Samsung\Easy Display Manager\HookDllPS2.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.07.04 17:57:22 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.04.29 11:36:50 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () [Auto | Running] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2009.06.17 11:18:42 | 006,582,912 | -H-- | M] () [On_Demand | Stopped] -- c:\wamp\bin\mysql\mysql5.1.36\bin\mysqld.exe -- (wampmysqld)
SRV - [2008.12.10 01:10:14 | 000,024,636 | -H-- | M] (Apache Software Foundation) [On_Demand | Stopped] -- c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe -- (wampapache)
SRV - [2008.05.13 00:47:20 | 000,077,480 | ---- | M] () [Auto | Stopped] -- C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe -- (Samsung Update Plus)
SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008.01.16 09:51:44 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2012.02.28 20:18:21 | 000,040,776 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2011.07.04 17:57:24 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.07.04 17:57:24 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.02.13 11:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008.12.10 04:11:51 | 000,013,312 | ---- | M] (SAMSUNG ELECTRONICS CO., LTD.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\KMDFMEMIO.sys -- (KMDFMEMIO)
DRV - [2008.10.25 06:16:32 | 004,017,152 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2008.08.28 06:39:34 | 000,241,664 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vmc302.sys -- (VMC302)
DRV - [2008.05.28 09:54:20 | 000,022,072 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbfilter.sys -- (usbfilter)
DRV - [2008.04.28 01:26:42 | 000,014,352 | ---- | M] (ATI Technologies Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AtiPcie.sys -- (AtiPcie) ATI PCI Express (3GIO)
DRV - [2008.04.27 03:07:00 | 000,909,824 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008.03.21 04:13:00 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2008.01.21 03:23:20 | 002,225,664 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2006.11.02 08:30:53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http:\\www.samsungcomputer.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "hxxp://start.icq.com/"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9
FF - prefs.js..extensions.enabledItems: finder@meingutscheincode.de:1.0.2
FF - prefs.js..extensions.enabledItems: {40c3cc16-7269-4b32-9531-17f2950fb06f}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.8.6
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.3.0.7550
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.0.14
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q="
 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\Bianca\AppData\Roaming\Move Networks\plugins\071803000001\npqmp071803000001.dll (Move Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.06.16 20:35:12 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.16 20:35:12 | 000,000,000 | ---D | M]
 
[2010.03.18 13:55:38 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Bianca\AppData\Roaming\mozilla\Extensions
[2009.06.11 18:06:33 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Bianca\AppData\Roaming\mozilla\Firefox\extensions
[2009.06.11 18:06:33 | 000,000,000 | -H-D | M] ("Ask Toolbar for Firefox") -- C:\Users\Bianca\AppData\Roaming\mozilla\Firefox\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
[2012.02.28 19:10:28 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Bianca\AppData\Roaming\mozilla\Firefox\Profiles\k9j63jl6.default\extensions
[2010.05.09 12:48:23 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Bianca\AppData\Roaming\mozilla\Firefox\Profiles\k9j63jl6.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.07.06 14:01:42 | 000,000,000 | -H-D | M] (Winload Toolbar) -- C:\Users\Bianca\AppData\Roaming\mozilla\Firefox\Profiles\k9j63jl6.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}
[2011.06.01 18:06:52 | 000,000,000 | -H-D | M] ("ICQ Toolbar") -- C:\Users\Bianca\AppData\Roaming\mozilla\Firefox\Profiles\k9j63jl6.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.05.22 09:55:21 | 000,000,000 | -H-D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\Bianca\AppData\Roaming\mozilla\Firefox\Profiles\k9j63jl6.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.08.17 13:53:32 | 000,000,000 | -H-D | M] ("DVDVideoSoft Menu") -- C:\Users\Bianca\AppData\Roaming\mozilla\Firefox\Profiles\k9j63jl6.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2010.07.28 15:35:04 | 000,000,000 | -H-D | M] (DVDVideoSoft Toolbar) -- C:\Users\Bianca\AppData\Roaming\mozilla\Firefox\Profiles\k9j63jl6.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010.07.06 14:01:40 | 000,000,000 | -H-D | M] (Mein Gutscheincode Finder) -- C:\Users\Bianca\AppData\Roaming\mozilla\Firefox\Profiles\k9j63jl6.default\extensions\finder@meingutscheincode.de
[2010.12.01 21:14:11 | 000,000,873 | -H-- | M] () -- C:\Users\Bianca\AppData\Roaming\Mozilla\Firefox\Profiles\k9j63jl6.default\searchplugins\conduit.xml
[2011.11.27 18:51:56 | 000,001,056 | -H-- | M] () -- C:\Users\Bianca\AppData\Roaming\Mozilla\Firefox\Profiles\k9j63jl6.default\searchplugins\icqplugin.xml
[2011.06.25 13:17:03 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.06.25 13:17:04 | 000,000,000 | ---D | M] (Skype extension) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.06.25 13:17:04 | 000,000,000 | ---D | M] (Skype extension) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2010.01.16 02:15:29 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.16 02:15:29 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.16 02:15:29 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.16 02:15:29 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.16 02:15:29 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (DVDVideoSoft Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Programme\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoft Toolbar) - {E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} - C:\Programme\DVDVideoSoft\tbDVDV.dll (Conduit Ltd.)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Cerberus] C:\Users\Bianca\AppData\Roaming\Cerberus\server.exe File not found
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Das YouTube Video als MP3 &speichern - C:\Users\Bianca\AppData\Roaming\Free YouTube to MP3 Converter Studio\Free YouTube to MP3 Converter Studio.htm ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\Bianca\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Bianca\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: lidl-fotos.de ([www] http in Lokales Intranet)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} hxxp://kitchenplanner.ikea.com/AT/Core/Player/2020PlayerAX_Win32.cab (20-20 3D Viewer)
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://www.lidl-fotos.de/ips-opdata/layout/lidl02/objects/jordan.cab (JordanUploader Class)
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} hxxp://express.foto.com/ImageUploader5.cab (Image Uploader Control)
O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab (CeWe Color AG & Co. OHG Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://javadl-esd.sun.com/update/1.6.0/jinstall-6-windows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} hxxp://as.photoprintit.de/ips-opdata/layout/default_cms01/activex/IPSUploader4.cab (IPSUploader4 Control)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{32EA1F30-2BC2-4204-BB2F-8F362A2B5C92}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D3F245C3-4FBD-4132-B45A-10756F297DED}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programme\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Bianca\AppData\Roaming\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O24 - Desktop BackupWallPaper: C:\Users\Bianca\AppData\Roaming\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - Unable to obtain root file information for disk D:\
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.02.28 20:18:21 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.02.28 20:17:23 | 000,000,000 | ---D | C] -- C:\Users\Bianca\AppData\Roaming\Malwarebytes
[2012.02.28 20:15:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.02.28 20:15:23 | 000,000,000 | -H-D | C] -- C:\ProgramData\Malwarebytes
[2012.02.28 20:15:21 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.02.28 20:15:20 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.02.28 19:11:37 | 000,000,000 | -H-D | C] -- C:\Users\Bianca\.jordan
[2012.02.26 17:38:47 | 000,000,000 | -H-D | C] -- C:\Users\Bianca\Desktop\Fotobestellung
[2012.02.26 11:08:53 | 000,000,000 | -H-D | C] -- C:\Users\Bianca\Desktop\21. Geburtstag Hannover
[2012.02.11 11:49:42 | 000,000,000 | -H-D | C] -- C:\Users\Bianca\AppData\Roaming\Free YouTube to MP3 Converter Studio
[2012.02.11 11:49:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free YouTube to MP3 Converter Studio
[2012.02.11 11:49:38 | 000,000,000 | ---D | C] -- C:\Program Files\Free YouTube to MP3 Converter Studio
[2012.02.11 11:25:41 | 000,000,000 | -H-D | C] -- C:\Users\Bianca\Desktop\I Tunes
[2012.02.11 11:21:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free M4a to MP3 Converter
[2012.02.11 11:21:40 | 000,000,000 | ---D | C] -- C:\Program Files\Free M4a to MP3 Converter
[2012.02.11 11:19:07 | 000,000,000 | -H-D | C] -- C:\Users\Bianca\Desktop\I Phone Ringtones
[1 C:\Users\Bianca\AppData\Roaming\*.tmp files -> C:\Users\Bianca\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.02.28 20:18:21 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.02.28 20:15:30 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.02.28 20:10:05 | 000,000,434 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{F2B133A8-7DAC-407F-A775-928DCE19523F}.job
[2012.02.28 19:53:41 | 000,004,912 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.02.28 19:53:41 | 000,004,912 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.02.28 19:53:31 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.02.28 19:53:27 | 3353,788,416 | -HS- | M] () -- C:\hiberfil.sys
[2012.02.28 19:52:50 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.02.11 11:49:42 | 000,000,922 | -H-- | M] () -- C:\Users\Bianca\Desktop\Free YouTube to MP3 Converter Studio.lnk
[2012.02.11 11:21:43 | 000,000,862 | -H-- | M] () -- C:\Users\Bianca\Desktop\Free M4a to MP3 Converter.lnk
[2012.02.11 11:21:43 | 000,000,857 | -H-- | M] () -- C:\Users\Bianca\Desktop\My Music Tools.lnk
[1 C:\Users\Bianca\AppData\Roaming\*.tmp files -> C:\Users\Bianca\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.02.28 20:15:30 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.02.11 11:49:42 | 000,000,922 | -H-- | C] () -- C:\Users\Bianca\Desktop\Free YouTube to MP3 Converter Studio.lnk
[2012.02.11 11:21:43 | 000,000,862 | -H-- | C] () -- C:\Users\Bianca\Desktop\Free M4a to MP3 Converter.lnk
[2012.02.11 11:21:43 | 000,000,857 | -H-- | C] () -- C:\Users\Bianca\Desktop\My Music Tools.lnk
[2010.08.31 17:51:14 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:4BB26BE9

< End of report >
--- --- ---

OTL EXTRAS Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 28.02.2012 20:38:45 - Run 1
OTL by OldTimer - Version 3.2.33.2     Folder = C:\Users\Bianca\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,12 Gb Total Physical Memory | 1,61 Gb Available Physical Memory | 51,70% Memory free
6,48 Gb Paging File | 5,02 Gb Available in Paging File | 77,50% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 144,09 Gb Total Space | 35,41 Gb Free Space | 24,58% Space Free | Partition Type: NTFS
Drive D: | 144,00 Gb Total Space | 143,91 Gb Free Space | 99,94% Space Free | Partition Type: NTFS
Unable to calculate disk information.
 
Computer Name: BIANCA-PC | User Name: Bianca | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0EFEF347-0B68-4263-A8C2-167E78778F99}" = lport=138 | protocol=17 | dir=in | app=system | 
"{3154797B-0D29-4C7B-A66D-DBE21EA876CF}" = lport=445 | protocol=6 | dir=in | app=system | 
"{4210E49A-DB4D-4B88-A5D1-226A445D4F20}" = rport=139 | protocol=6 | dir=out | app=system | 
"{47556A29-817C-4857-A99F-69CA5BA6A1EF}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{5F60337D-A21A-4989-899B-B1F1DBD1710C}" = rport=138 | protocol=17 | dir=out | app=system | 
"{6C1FF578-DBFF-47F5-9A44-55FE11CA636E}" = rport=137 | protocol=17 | dir=out | app=system | 
"{713A53EE-74F8-40DB-9A90-C419D2D4654F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{99395CD6-17A8-425D-9B71-4DB2AB2BC8AE}" = rport=445 | protocol=6 | dir=out | app=system | 
"{B9DE7B00-B76E-44BC-A84F-72736A56CF5C}" = lport=137 | protocol=17 | dir=in | app=system | 
"{BBC31C6B-580B-41A9-9B99-2F5F091CD961}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{C015BE96-3A44-4712-80F8-8DFBF6C9B407}" = lport=139 | protocol=6 | dir=in | app=system | 
"{E7A5E461-4508-4101-9D24-FBA24A7266F1}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | 
"{EFDF50B3-BEF1-4650-A022-DCBA030294FC}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03883B8F-B191-4E36-B3C9-55D2B9FD7017}" = protocol=6 | dir=in | app=c:\program files\icq7.1\aolload.exe | 
"{08DF74E5-D506-4D95-A9CF-C1DEAED9841F}" = protocol=6 | dir=in | app=c:\program files\icq7.1\icq.exe | 
"{21D8B88F-FDDA-43ED-B70C-709BC7FA8B9F}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{25166354-CC0E-4EF4-A02B-2F4078832BC6}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{2D00162C-E68B-49ED-9E54-24653E1500A5}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{35FD425D-7B16-48F1-A56E-BCBE2FE5826D}" = protocol=6 | dir=in | app=c:\program files\icq7.1\aolload.exe | 
"{3AD4E780-D2FC-45CC-8C3C-1B3ABEB56069}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{41EAF463-21C3-46AA-8129-0AB1528537C7}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe | 
"{46EBE8FE-999F-46F6-B7B8-C662A387BC5A}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{4A12842B-07D7-4243-9D52-93E22DE016F1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{4DEB5648-7279-4DE3-8CCC-56D6FD0E499C}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{5262EEE4-73D2-42AC-B441-ECF1792D0A5B}" = protocol=6 | dir=in | app=c:\program files\icq7.1\aolload.exe | 
"{55A6CA9F-E2C1-4F32-9B9A-9484E065B270}" = protocol=17 | dir=in | app=c:\program files\icq7.1\aolload.exe | 
"{55C98F29-A93E-478E-BFEC-CBA9E73C5B9C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{620C3E57-C338-4102-9854-C29050B613F9}" = protocol=17 | dir=in | app=c:\program files\icq7.1\icq.exe | 
"{7411D45E-55BE-42C9-907C-08CBD8D3F642}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{7AEAC5CA-C49E-44A6-B0E2-30FE8B54A47C}" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"{88911BCB-C985-4AB2-BF6C-D69340536B58}" = protocol=17 | dir=in | app=c:\program files\icq7.1\aolload.exe | 
"{8A8D71B4-97E3-49E2-9E33-6019A46A5929}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{8F5182B6-6320-4012-B342-725BF9032D1C}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | 
"{9EB63815-2278-4CDC-B354-4803045BBBDD}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{A83A0195-59E0-4E57-8994-8A24DD976C56}" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"{AD30C606-7875-4464-BAFC-C913A3A50FA5}" = protocol=6 | dir=in | app=c:\program files\icq7.1\icq.exe | 
"{B7D6A218-4A88-4560-93F6-2357616FE322}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{BE34FD04-4454-4CF4-AF61-C658A37E7637}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 
"{C152EF43-84B4-46F6-90C7-317BD9BD1742}" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"{C5BC59AA-1884-4533-8EE9-FD6C85EB5161}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{C8B213D3-FCFA-4808-9282-37C5BA401359}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{D2BD8E64-7EFE-4548-BCD9-0F32F5B04DFC}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{D8F844A1-F2F3-48B5-BF3B-B3A03948EA60}" = protocol=6 | dir=in | app=c:\program files\icq7.1\icq.exe | 
"{DDD25142-434D-4BB2-A47F-051E5434C72A}" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"{E32AAAC5-1112-47FD-BE2C-72BF5F2AAE09}" = protocol=17 | dir=in | app=c:\program files\icq7.1\aolload.exe | 
"{E399DE05-DFF1-40F4-B23A-DE6C41A84212}" = protocol=17 | dir=in | app=c:\program files\icq7.1\icq.exe | 
"{E4AD6DE0-98DC-47A0-92E0-58CC5F3B0958}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{E82B29DB-2364-4C4C-B110-B9D1E833D21E}" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"{E86186FB-DB82-4D9E-AD91-1B0EE661BFCE}" = protocol=17 | dir=in | app=c:\program files\icq7.1\icq.exe | 
"{EAA69784-1BDD-494C-84C6-50E877737840}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\groove.exe | 
"{EE9B8DAA-5A7B-4182-906C-77D98E539C0D}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{F09F8499-F753-4375-9502-B884E9F06C35}" = dir=in | app=c:\program files\cyberlink\powerdvd\powerdvd.exe | 
"{F2DAC385-4E7F-4B38-8379-1885E38DD881}" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 
"{F7B44CE9-5DC5-4B2D-A53C-B574AD5FAFC6}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"TCP Query User{9BD88483-FA2B-46F8-A72F-13C240D4BC28}C:\users\public\games\world of warcraft\launcher.patch.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.patch.exe | 
"TCP Query User{F4C337E5-6BD9-4361-8770-CB3A55978A31}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{5DF3E50E-5D07-48A4-B36B-5D027F19AE75}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{61CF45C3-5A57-4673-874F-EA9C80090883}C:\users\public\games\world of warcraft\launcher.patch.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.patch.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{004C5DA2-2051-4D25-94BA-51CF810C91EB}" = LightScribe System Software  1.12.37.1
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{035ED630-CD5A-170B-C723-7D3975E14CD6}" = CCC Help Italian
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.0.1.6300
"{04983D37-2202-4295-94A2-8B547C66133F}" = Atheros WLAN Client
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{073C822A-3B33-D269-37C7-635C238E53AC}" = Catalyst Control Center Localization Polish
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{0EC85B2E-5F72-B7F6-7C2B-BE68F5A3325E}" = CCC Help English
"{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III
"{148A4916-9CAE-9A65-E3D4-13AF550FB718}" = CCC Help Norwegian
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{17BC8ED4-356E-A916-82E9-6CE3813A0D8A}" = Catalyst Control Center Graphics Full Existing
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{231F1242-35FB-4A1F-8E93-600BCE767941}" = Samsung Mobility Panel
"{2517CAE7-021A-6724-448D-058E8B490CED}" = CCC Help French
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java(TM) 6 Update 12
"{2769D19E-EFE3-8528-A0F1-F1CFEFBFA00A}" = Catalyst Control Center Localization Norwegian
"{29CEA792-6EAC-4B7F-073E-AC875CDA52D9}" = CCC Help Thai
"{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor
"{343666E2-A059-48AC-AD67-230BF74E2DB2}" = Apple Application Support
"{36BEAD11-8577-49AD-9250-E06A50AE87B0}" = Microsoft SOAP Toolkit 2.0 SP2
"{3A284CD1-FD1D-3CC5-5453-0F7D54CF6C73}" = CCC Help Turkish
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D9F5B9D-9F36-A008-BAEC-CFD34F148473}" = ATI Catalyst Install Manager
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{42BFCDE1-6564-0A38-6F28-E8AEE81B8F04}" = Catalyst Control Center Localization Greek
"{4C9CC077-601E-2C91-FA8F-547E88E15FD1}" = CCC Help Danish
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{4CE975F1-D54F-E047-1975-B63EF6B2C42A}" = CCC Help Russian
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{50EF1669-0EF3-5BD2-6C67-B92FD3B3C80C}" = CCC Help Japanese
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{5522BA88-841B-3298-F228-D5ACBC087423}" = Catalyst Control Center Localization Swedish
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5A5E1D67-52D6-8767-D02C-88C8C19862CD}" = Catalyst Control Center Localization Dutch
"{5BC38BD0-8F31-34AC-3875-3D19B158D2ED}" = Catalyst Control Center Localization Finnish
"{5CCD890F-C9CD-B85A-5C31-A4582BA780E1}" = ccc-utility
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{6219FDFB-D0E3-5ECB-022B-7D5CE2B50DD6}" = CCC Help Finnish
"{65C729B4-DA4C-3988-0B38-829B3F95A75A}" = Catalyst Control Center Localization Portuguese
"{67EDD823-135A-4D59-87BD-950616D6E857}" = EPSON Copy Utility 3
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"{68BFE2BF-C6AE-0D0F-7EF0-C19A4C649203}" = CCC Help Spanish
"{6A239DFD-249A-DDDA-484A-5A046BB29465}" = CCC Help Portuguese
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6C1E7AA1-44E9-446D-AAB2-0DE6D9EFEAB1}" = Safari
"{6D94DA09-DEF3-9EF7-D898-F1C97C34F9EF}" = CCC Help Korean
"{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Easy Battery Manager
"{6FBCF7BB-BBF0-6BB8-40EA-B0A0C90E6316}" = Skins
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71A51B09-E7D3-11DB-A386-005056C00008}" = Vimicro UVC Camera
"{72393226-892B-68C8-21C6-3143ED4F863F}" = Catalyst Control Center Localization Korean
"{735105FD-05BC-4B99-525D-C775F42A9A06}" = Catalyst Control Center Core Implementation
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{779DECD7-E072-4B56-9B6B-BEB5973EEEB5}" = MobileMe Control Panel
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7986B74C-EE93-70BE-FCCF-86AD42D5B84E}" = CCC Help Czech
"{804F1285-8CBF-408D-8CDC-D4D40003B2E4}" = PlayCamera
"{8153ED9A-C94A-426E-9880-5E6775C08B62}" = Apple Mobile Device Support
"{8B26A8AF-8244-D0B5-2543-2CA246E71DB2}" = Catalyst Control Center Localization Chinese Traditional
"{8E106A57-A17E-431D-B48F-175E42EB9F74}" = imagine digital freedom - Samsung
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0015-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}_PROHYBRIDR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0407-0000-0000000FF1CE}_PROHYBRIDR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{90D1E40E-8CC1-B37C-9029-C1FDD50EA15C}" = Catalyst Control Center Localization Spanish
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{921CA2C6-F07D-E7E3-1B61-335BDC390CB9}" = Catalyst Control Center Localization Danish
"{927D70C9-60D5-9E8E-C034-A039E6A061AB}" = CCC Help Dutch
"{94326847-F1D6-604A-E4C4-A048916E4A5C}" = Catalyst Control Center Localization Turkish
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9692E466-E68A-8005-F101-BB47791ECCDF}" = Catalyst Control Center Localization Russian
"{992CD0F2-C0A9-F53A-335E-A436A321792D}" = Catalyst Control Center Graphics Full New
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E62B059-B0C6-9D7F-969B-E25ABF08A3C8}" = Catalyst Control Center Localization French
"{A258280F-131D-E187-62B5-9D6A3317742D}" = Catalyst Control Center Localization Japanese
"{A2EDDF40-A923-7E74-A6B6-B8EEBD66D18D}" = CCC Help Chinese Standard
"{A3AB35FA-943E-4799-99DC-46EFD59E998F}" = AMD USB Audio Driver Filter
"{A7581D39-EA20-4883-A480-80C21047052B}" = Easy Network Manager
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{B632422A-A9A6-77F6-19D9-EB4616A03C10}" = Catalyst Control Center Graphics Light
"{B69D6E3C-BEFD-0581-4BE5-DFD89ECCFC46}" = Catalyst Control Center Localization Italian
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{B7DBF6E8-0D17-4BE4-853B-ACD6EFBD4A1F}" = iTunes
"{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}" = User Guide
"{BDE81949-C0E8-238B-2ACC-E10EDCC3B243}" = CCC Help Polish
"{C3B233DC-0CA2-3740-4EBC-AA138573751A}" = Catalyst Control Center Localization German
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = PowerDirector
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D3008D96-86EB-7713-AAFD-E435D8F3A059}" = ccc-core-static
"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3
"{D9872610-D0CF-DA80-1FE7-773E11EF3F85}" = CCC Help Chinese Traditional
"{DE52F223-E4BD-D900-4CCB-EB060883FD96}" = Catalyst Control Center Localization Czech
"{E05BD952-C7B4-0AF8-4F82-BF51D25D9DE4}" = CCC Help German
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{E5419254-D801-17E4-FD02-492D78177C7E}" = Catalyst Control Center Localization Hungarian
"{E713653C-8312-4BC6-AFC9-ADE1F2F04AB9}" = ATI PCI Express (3GIO) Filter Driver
"{EBCD08C0-81F9-6614-EE3D-0760C594B39E}" = CCC Help Hungarian
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager
"{F0581D83-9155-B015-B395-0258EBDA2D5B}" = Catalyst Control Center Graphics Previews Vista
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F37CB741-A570-D403-300B-25F682D33F8A}" = CCC Help Swedish
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F5594F78-6B67-85DB-AD30-2F2BCAAD509D}" = Catalyst Control Center Localization Chinese Standard
"{F64B9D07-14D4-4DC6-9C34-D28F0C644F9A}" = Catalyst Control Center - Branding
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F83EE0F9-A36D-0AFF-59F1-6D69852E4371}" = CCC Help Greek
"{F8413786-48E7-FA4F-474A-CF573131140D}" = Catalyst Control Center InstallProxy
"{F886EE71-F8C5-1C35-2AC0-C2288C429C0E}" = Catalyst Control Center Localization Thai
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Ask Toolbar_is1" = Ask Toolbar
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"DVDVideoSoft Toolbar" = DVDVideoSoft Toolbar
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EPSON Printer and Utilities" = EPSON-Drucker-Software
"EPSON Scanner" = EPSON Scan
"ESDX4000_4050_CX3900" = ESDX4000_4050_CX3900
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free Audio CD to MP3 Converter_is1" = Free Audio CD to MP3 Converter version 1.1
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 7.0
"Free Studio_is1" = Free Studio version 4.8
"Free YouTube Download_is1" = Free YouTube Download version 3.0.0.602
"Free YouTube to iPod Converter_is1" = Free YouTube to iPod Converter version 2.9
"Free YouTube to MP3 Converter Studio_is1" = Free YouTube to MP3 Converter Studio 7.1
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.40.602
"ICQToolbar" = ICQ Toolbar
"InstallShield_{685707A4-911C-468D-BFC4-64A50E5E3A0C}" = Samsung Update Plus
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000
"Marvell Miniport Driver" = Marvell Miniport Driver
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox (3.6)" = Mozilla Firefox (3.6)
"phase5" = phase5
"PhotoScape" = PhotoScape
"Picasa 3" = Picasa 3
"PROHYBRIDR" = 2007 Microsoft Office system
"Sony Ericsson Themes Creator" = Sony Ericsson Themes Creator 4.12.2.4
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Uninstall_is1" = Uninstall 1.0.0.1
"WampServer 2_is1" = WampServer 2.0
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"World of Warcraft" = World of Warcraft
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Media Player" = Move Media Player
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 05.01.2011 17:30:27 | Computer Name = Bianca-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 06.01.2011 06:54:05 | Computer Name = Bianca-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 06.01.2011 14:26:32 | Computer Name = Bianca-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18542 arbeitet nicht mehr 
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen 
über das Problem zu suchen.  Prozess-ID: 16bc  Anfangszeit: 01cbadccc0308510  Zeitpunkt
 der Beendigung: 0
 
Error - 06.01.2011 14:28:12 | Computer Name = Bianca-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18542 arbeitet nicht mehr 
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen 
über das Problem zu suchen.  Prozess-ID: 1ff0  Anfangszeit: 01cbadcf3e732c50  Zeitpunkt
 der Beendigung: 16
 
Error - 07.01.2011 07:39:09 | Computer Name = Bianca-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 07.01.2011 14:49:32 | Computer Name = Bianca-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 08.01.2011 07:00:10 | Computer Name = Bianca-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 08.01.2011 10:23:43 | Computer Name = Bianca-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 08.01.2011 16:59:26 | Computer Name = Bianca-PC | Source = EventSystem | ID = 4621
Description = 
 
Error - 09.01.2011 07:57:16 | Computer Name = Bianca-PC | Source = WinMgmt | ID = 10
Description = 
 
[ OSession Events ]
Error - 16.09.2009 16:09:14 | Computer Name = Bianca-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 406
 seconds with 240 seconds of active time.  This session ended with a crash.
 
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
--- --- ---



MBR
Code:
ATTFilter
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows Vista Home Premium Edition
Windows Information:		Service Pack 1 (build 6001), 32-bit
Base Board Manufacturer:	SAMSUNG ELECTRONICS CO., LTD.
BIOS Manufacturer:		Phoenix Technologies Ltd.
System Manufacturer:		SAMSUNG ELECTRONICS CO., LTD.
System Product Name:		R505
Logical Drives Mask:		0x0000001c

Kernel Drivers (total 138):
  0x81E09000 \SystemRoot\system32\ntkrnlpa.exe
  0x821C2000 \SystemRoot\system32\hal.dll
  0x80407000 \SystemRoot\system32\kdcom.dll
  0x8040F000 \SystemRoot\system32\PSHED.dll
  0x80420000 \SystemRoot\system32\BOOTVID.dll
  0x80428000 \SystemRoot\system32\CLFS.SYS
  0x80469000 \SystemRoot\system32\CI.dll
  0x80549000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x805C5000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x80603000 \SystemRoot\system32\drivers\acpi.sys
  0x80649000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x80652000 \SystemRoot\system32\drivers\msisadrv.sys
  0x8065A000 \SystemRoot\system32\drivers\pci.sys
  0x80681000 \SystemRoot\System32\drivers\partmgr.sys
  0x80690000 \SystemRoot\system32\DRIVERS\compbatt.sys
  0x80693000 \SystemRoot\system32\DRIVERS\BATTC.SYS
  0x8069D000 \SystemRoot\system32\drivers\volmgr.sys
  0x806AC000 \SystemRoot\System32\drivers\volmgrx.sys
  0x806F6000 \SystemRoot\System32\drivers\mountmgr.sys
  0x80706000 \SystemRoot\system32\drivers\atapi.sys
  0x8070E000 \SystemRoot\system32\drivers\ataport.SYS
  0x8072C000 \SystemRoot\system32\drivers\msahci.sys
  0x80736000 \SystemRoot\system32\drivers\PCIIDEX.SYS
  0x80744000 \SystemRoot\system32\drivers\fltmgr.sys
  0x80776000 \SystemRoot\system32\drivers\fileinfo.sys
  0x80786000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x8A20F000 \SystemRoot\system32\drivers\ndis.sys
  0x8A31A000 \SystemRoot\system32\drivers\msrpc.sys
  0x8A345000 \SystemRoot\system32\drivers\NETIO.SYS
  0x8A40F000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x8A51E000 \SystemRoot\system32\drivers\volsnap.sys
  0x8A557000 \SystemRoot\System32\Drivers\spldr.sys
  0x8A55F000 \SystemRoot\System32\Drivers\mup.sys
  0x8A56E000 \SystemRoot\System32\drivers\ecache.sys
  0x8A595000 \SystemRoot\system32\drivers\disk.sys
  0x8A5A6000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x8A5C7000 \SystemRoot\system32\DRIVERS\AtiPcie.sys
  0x8A5CF000 \SystemRoot\system32\drivers\crcdisk.sys
  0x8A400000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x8A37F000 \SystemRoot\system32\DRIVERS\tunmp.sys
  0x8A388000 \SystemRoot\system32\DRIVERS\processr.sys
  0x8DA06000 \SystemRoot\system32\DRIVERS\atikmdag.sys
  0x8E00D000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x8E0AC000 \SystemRoot\System32\drivers\watchdog.sys
  0x8E0B9000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x8E0CB000 \SystemRoot\system32\DRIVERS\athr.sys
  0x8E1AF000 \SystemRoot\system32\DRIVERS\yk60x86.sys
  0x8DFC6000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8E000000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
  0x8DFDE000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0x8A397000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x8DFE8000 \SystemRoot\system32\DRIVERS\usbfilter.sys
  0x8E006000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x8DFF1000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x8A3D5000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x8A3E8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x805D2000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0x8A3F3000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x8E008000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0x8E408000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x8E436000 \SystemRoot\system32\DRIVERS\storport.sys
  0x8E477000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x8E482000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x8E499000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x8E4A4000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x8E4C7000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x8E4D6000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x8E4EA000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x8E4FF000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x8E50F000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x8E511000 \SystemRoot\system32\DRIVERS\ks.sys
  0x8E53B000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x8E545000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x8E552000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x8E586000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x8E597000 \SystemRoot\system32\drivers\HdAudio.sys
  0x8E800000 \SystemRoot\system32\drivers\portcls.sys
  0x8E82D000 \SystemRoot\system32\drivers\drmk.sys
  0x8EA01000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x8EC0E000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x8EC17000 \SystemRoot\System32\Drivers\Null.SYS
  0x8EC1E000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8EC25000 \SystemRoot\System32\drivers\vga.sys
  0x8EC31000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8EC52000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8EC5A000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x8EC62000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8EC6D000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8EC7B000 \SystemRoot\System32\DRIVERS\rasacd.sys
  0x8EC84000 \SystemRoot\System32\drivers\tcpip.sys
  0x8ED6D000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x8ED88000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x8ED9E000 \SystemRoot\system32\DRIVERS\smb.sys
  0x8EDB2000 \SystemRoot\system32\drivers\afd.sys
  0x8E852000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x8E884000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x8E89A000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x8E8A8000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8EDFA000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
  0x8E8BB000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x8E8F7000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x8E901000 \SystemRoot\System32\Drivers\dfsc.sys
  0x8E918000 \SystemRoot\system32\DRIVERS\avipbb.sys
  0x8E93F000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0x8E956000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
  0x8E958000 \SystemRoot\System32\Drivers\VMC302.sys
  0x8E993000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0x8E9A9000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x8E9B6000 \SystemRoot\System32\Drivers\dump_dumpata.sys
  0x8E9C1000 \SystemRoot\System32\Drivers\dump_msahci.sys
  0x97030000 \SystemRoot\System32\win32k.sys
  0x8E9CB000 \SystemRoot\System32\drivers\Dxapi.sys
  0x8E9D5000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x97250000 \SystemRoot\System32\TSDDD.dll
  0x8E9E4000 \SystemRoot\system32\drivers\luafv.sys
  0x8E5D6000 \SystemRoot\system32\DRIVERS\avgntflt.sys
  0x8E5ED000 \SystemRoot\system32\DRIVERS\kmdfmemio.sys
  0x9AE08000 \SystemRoot\system32\drivers\spsys.sys
  0x9AEB7000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x9AEC7000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0x9AEF1000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0x9AEFB000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x9AF0E000 \SystemRoot\system32\drivers\HTTP.sys
  0x9AF7B000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0x9AF98000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x9AFB1000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x9AFC6000 \SystemRoot\system32\drivers\mrxdav.sys
  0x8A5D8000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x9C009000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x9C042000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x9C05A000 \SystemRoot\System32\DRIVERS\srv2.sys
  0x9C082000 \SystemRoot\System32\DRIVERS\srv.sys
  0x9C0E9000 \SystemRoot\system32\drivers\peauth.sys
  0x9C1C7000 \SystemRoot\System32\Drivers\secdrv.SYS
  0x9C1D1000 \SystemRoot\System32\drivers\tcpipreg.sys
  0x97290000 \SystemRoot\System32\cdd.dll
  0x9C1E5000 \??\C:\Windows\system32\drivers\mbamswissarmy.sys
  0x76FF0000 \Windows\System32\ntdll.dll

Processes (total 100):
       0 System Idle Process
       4 System
     456 C:\Windows\System32\smss.exe
     552 csrss.exe
     616 C:\Windows\System32\wininit.exe
     624 csrss.exe
     660 C:\Windows\System32\services.exe
     672 C:\Windows\System32\lsass.exe
     680 C:\Windows\System32\lsm.exe
     728 C:\Windows\System32\winlogon.exe
     856 C:\Windows\System32\svchost.exe
     928 C:\Windows\System32\svchost.exe
     972 C:\Windows\System32\svchost.exe
    1088 C:\Windows\System32\Ati2evxx.exe
    1104 C:\Windows\System32\svchost.exe
    1176 C:\Windows\System32\svchost.exe
    1208 C:\Windows\System32\svchost.exe
    1276 C:\Windows\System32\audiodg.exe
    1312 C:\Windows\System32\SLsvc.exe
    1344 C:\Windows\System32\svchost.exe
    1524 C:\Windows\System32\svchost.exe
    1556 C:\Windows\System32\Ati2evxx.exe
    1672 C:\Windows\System32\wlanext.exe
    1772 C:\Windows\System32\spoolsv.exe
    1816 C:\Program Files\Avira\AntiVir Desktop\sched.exe
    1868 C:\Windows\System32\svchost.exe
     468 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
     528 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
     556 C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
     652 C:\Program Files\Bonjour\mDNSResponder.exe
     848 C:\Windows\System32\svchost.exe
    1012 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
    1264 C:\Program Files\ICQ6Toolbar\ICQ Service.exe
    2080 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    2116 C:\Windows\System32\svchost.exe
    2132 C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    2172 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
    2216 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
    2272 C:\Windows\System32\svchost.exe
    2304 C:\Windows\System32\svchost.exe
    2348 C:\Windows\System32\SearchIndexer.exe
    3020 C:\Windows\System32\dwm.exe
    3028 C:\Windows\System32\taskeng.exe
    3076 C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
    3104 C:\Windows\explorer.exe
    3120 C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe
    3132 C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
    3160 C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
    3520 C:\Program Files\Windows Defender\MSASCui.exe
    3536 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    3544 C:\Windows\RtHDVCpl.exe
    3608 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    3812 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    3832 C:\Program Files\Java\jre6\bin\jusched.exe
    3892 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    3920 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    3988 C:\Program Files\iTunes\iTunesHelper.exe
    4000 C:\Program Files\Windows Sidebar\sidebar.exe
    4040 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
    2160 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    1912 C:\Program Files\iPod\bin\iPodService.exe
    2644 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    3460 C:\Windows\System32\wsqmcons.exe
    3984 csrss.exe
    2320 C:\Windows\System32\winlogon.exe
    3736 C:\Windows\System32\Ati2evxx.exe
    2780 C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    2996 C:\Windows\System32\taskeng.exe
    2476 C:\Windows\System32\dwm.exe
     240 C:\Windows\explorer.exe
    2544 C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe
    3808 C:\Windows\System32\taskeng.exe
    4084 C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
Unhide:
Code:
ATTFilter
Unhide by Lawrence Abrams (Grinler)
hxxp://www.bleepingcomputer.com/
Copyright 2008-2012 BleepingComputer.com
More Information about Unhide.exe can be found at this link:
  hxxp://www.bleepingcomputer.com/forums/topic405109.html

Program started at: 02/29/2012 03:55:31 PM
Windows Version: Windows Vista

Please be patient while your files are made visible again.

Processing the C:\ drive
Finished processing the C:\ drive. 213073 files processed.

Processing the D:\ drive
Finished processing the D:\ drive. 7 files processed.

Restoring the Start Menu.
 * 20 Shortcuts and Desktop items were restored.


Searching for Windows Registry changes made by FakeHDD rogues.
 - Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  * Start_TrackDocs was set to 0! It was set back to 1!
  * Start_TrackProgs was set to 0! It was set back to 1!

Program finished at: 02/29/2012 04:00:08 PM
Execution time: 0 hours(s), 4 minute(s), and 37 seconds(s)

Jetzt zeigt er zwar keine Fehlermeldung mehr an, aber alle Dateien sind immernoch nicht wieder da.
Geändert von Bianca_2202 (29.02.2012 um 17:21 Uhr)

Alt 29.02.2012, 16:53   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows detected a hard disk problem. - Standard

Windows detected a hard disk problem.


Zitat:
PRC - [2012.01.13 14:53:16 | 000,981,680 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbam.exe
Wo sind die Logs von Malwarebytes? Solche immer gleich mitposten!

Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
ATTFilter
 hier steht das Log
__________________

__________________
Alt 29.02.2012, 16:56   #3
Bianca_2202
 
Windows detected a hard disk problem. - Standard

Windows detected a hard disk problem.


Code:
ATTFilter
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.28.04

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
Bianca :: BIANCA-PC [Administrator]

29.02.2012 13:23:43
mbam-log-2012-02-29 (13-23-43).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 370518
Laufzeit: 2 Stunde(n), 2 Minute(n), 37 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 1
HKCU\SOFTWARE\Cerberus (Backdoor.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Cerberus (Backdoor.Bot) -> Daten: C:\Users\Bianca\AppData\Roaming\Cerberus\server.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowMyComputer (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced|Start_ShowSearch (PUM.Hijack.StartMenu) -> Bösartig: (0) Gut: (1) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\Bianca\AppData\Local\Temp\ARi6lmWbll0BC0.exe.tmp (Rogue.FakeHDD) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Bianca\AppData\Local\Temp\fsa119190.exe (Rogue.FakeHDD) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
__________________
Alt 29.02.2012, 17:23   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows detected a hard disk problem. - Standard

Windows detected a hard disk problem.


Malwarebytes erstellt bei jedem Scanvorgang genau ein Log. Hast du in der Vergangenheit schonmal mit Malwarebytes gescannt?
Wenn ja dann stehen auch alle Logs zu jedem Scanvorgang im Reiter Logdateien. Bitte alle posten, die dort sichtbar sind.
__________________
Logfiles bitte immer in CODE-Tags posten

Antwort

Themen zu Windows detected a hard disk problem.
alternate, antivir, askbar, autorun, avira, bho, bonjour, conduit, converter, desktop, error, firefox, flash player, home, install.exe, intranet, logfile, microsoft office 2003, microsoft office word, mp3, office 2007, plug-in, problem, realtek, registry, rundll, scan, security, security update, senden, server, software, studio, svchost.exe, version=1.0, vista, windows, winload toolbar


« Windows aus Sicherheitsgründen gesperrt | GEMA-Trojaner »


Ähnliche Themen: Windows detected a hard disk problem.


  1. Dringend! Windows detected hard disk problem - alle Daten gehen verloren?
    Plagegeister aller Art und deren Bekämpfung - 08.11.2014 (10)
  2. Dringend! Windows detected hard disk problem - alle Daten gehen verloren?
    Lob, Kritik und Wünsche - 07.11.2014 (0)
  3. system error hard disk failure detected
    Plagegeister aller Art und deren Bekämpfung - 20.06.2012 (1)
  4. System Error. Hard disk failure detected
    Log-Analyse und Auswertung - 07.06.2012 (5)
  5. SYSTEM ERROR. Hard disk failure detected
    Plagegeister aller Art und deren Bekämpfung - 17.05.2012 (1)
  6. Virus: Windows detected a hard disk problem - WinXP
    Plagegeister aller Art und deren Bekämpfung - 22.03.2012 (5)
  7. Windows detected a hard disk problem
    Plagegeister aller Art und deren Bekämpfung - 22.03.2012 (1)
  8. Windows detected a hard disk problem
    Plagegeister aller Art und deren Bekämpfung - 19.03.2012 (4)
  9. Windows detected a hard disk problem
    Plagegeister aller Art und deren Bekämpfung - 26.02.2012 (3)
  10. windows detected a hard disk problem
    Plagegeister aller Art und deren Bekämpfung - 06.02.2012 (3)
  11. Windows detected a hard disk problem
    Plagegeister aller Art und deren Bekämpfung - 19.01.2012 (12)
  12. Windows detected a hard disk problem / Windows - Delayed Write Failed
    Plagegeister aller Art und deren Bekämpfung - 12.12.2011 (8)
  13. Windows - Delayed Write Failed/Windows detected a hard disk problem
    Log-Analyse und Auswertung - 12.12.2011 (1)
  14. Anfänger! "Windows detected a hard disk problem"
    Plagegeister aller Art und deren Bekämpfung - 02.12.2011 (9)
  15. "Windows detected a hard disk problem" A potential disc failure... Hilfe :( :( :(
    Log-Analyse und Auswertung - 19.11.2011 (1)
  16. Windows detected a hard disk problem // critical error \\System32\\00005d03
    Log-Analyse und Auswertung - 05.11.2011 (38)
  17. "Windows detected a hard disk problem" - Fake
    Plagegeister aller Art und deren Bekämpfung - 27.10.2011 (3)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Windows detected a hard disk problem. - Hallo, also ich habe eine Problem... Seit gestern sagt mein PC: "Windows detected a hard disk problem" und es tut sich nichts mehr. Ich habe hier http://www.trojaner-board.de/106078-...te-failed.html das gleich problem - Windows detected a hard disk problem....
Archiv
Du betrachtest: Windows detected a hard disk problem. auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54