| |
| |||||||
Log-Analyse und Auswertung: Weißer Bildschirm mit Ucash Zahlungsaufforderung 100 €Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
17.03.2012, 02:02
| #1 |
| |  Weißer Bildschirm mit Ucash Zahlungsaufforderung 100 € Liebe Experten, ich habe, wie so viele, mir wohl ein Schadprogramm eingefangen, was bei mir Windows lahmgelegt hat und mich zur Zahlung von 100 € auffordert. Ich konnte mein Windows Vista im abgesicherten Modus mit Netzwerktreibern starten, habe OTL installiert und ausgeführt. Hier das Ergebnis OTL.txt:OTL Logfile: Code:
ATTFilter OTL logfile created on: 17.03.2012 01:44:36 - Run 2 OTL by OldTimer - Version 3.2.37.1 Folder = C:\Users\Rüdiger Lotze\Desktop Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,00 Gb Total Physical Memory | 2,33 Gb Available Physical Memory | 77,84% Memory free 6,19 Gb Paging File | 5,72 Gb Available in Paging File | 92,36% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 298,09 Gb Total Space | 152,21 Gb Free Space | 51,06% Space Free | Partition Type: NTFS Drive D: | 298,09 Gb Total Space | 200,65 Gb Free Space | 67,31% Space Free | Partition Type: NTFS Drive F: | 149,01 Gb Total Space | 77,54 Gb Free Space | 52,03% Space Free | Partition Type: FAT32 Computer Name: ****-PC | User Name: **** | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.03.17 01:01:42 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Users\****\Desktop\OTL.exe PRC - [2010.06.28 15:54:38 | 000,339,968 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows NT\Accessories\wordpad.exe PRC - [2009.04.11 07:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008.01.21 03:24:02 | 000,498,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\HelpPane.exe ========== Modules (No Company Name) ========== MOD - [2010.12.26 17:44:04 | 000,043,520 | ---- | M] () -- C:\Windows\System32\CmdLineExt03.dll MOD - [2007.06.08 09:43:38 | 000,017,920 | ---- | M] () -- C:\Programme\NewTech Infosystems\NTI Shadow\ShadowSvrLoc.dll MOD - [2007.03.02 11:44:34 | 000,073,728 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll ========== Win32 Services (SafeList) ========== SRV - [2012.02.23 12:45:31 | 000,690,352 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Auto | Stopped] -- C:\Programme\StarMoney 8.0 apoEdition\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney 8.0 OnlineUpdate) SRV - [2011.11.08 11:54:25 | 000,554,160 | ---- | M] (Star Finanz - Software Entwicklung und Vertriebs GmbH) [Auto | Stopped] -- C:\Programme\StarMoney 7.0 apoEdition\ouservice\StarMoneyOnlineUpdate.exe -- (StarMoney 7.0 OnlineUpdate) SRV - [2011.10.11 13:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.10.11 13:59:39 | 000,463,824 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe -- (AntiVirWebService) SRV - [2011.10.11 13:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2010.05.06 10:29:12 | 000,293,456 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2010.03.30 10:53:32 | 000,153,464 | ---- | M] (AVM Berlin) [Auto | Stopped] -- C:\Programme\FRITZ!Fernzugang\nwtsrv.exe -- (nwtsrv) SRV - [2010.03.30 10:52:24 | 000,121,720 | ---- | M] (AVM Berlin) [Auto | Stopped] -- C:\Programme\FRITZ!Fernzugang\certsrv.exe -- (certsrv) SRV - [2010.03.30 10:51:30 | 000,254,328 | ---- | M] (AVM Berlin) [Auto | Stopped] -- C:\Programme\FRITZ!Fernzugang\avmike.exe -- (avmike) SRV - [2009.05.01 16:57:50 | 000,077,032 | ---- | M] (Entriq, Inc.) [Auto | Stopped] -- C:\Program Files\maxdome\DCBin\DCService.exe -- (Prosieben) SRV - [2009.01.08 09:42:54 | 000,233,472 | ---- | M] (Teruten) [Auto | Stopped] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService) SRV - [2008.09.15 18:27:30 | 000,554,264 | ---- | M] (Acronis) [Auto | Stopped] -- C:\Programme\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc) SRV - [2008.01.21 03:25:33 | 000,896,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2008.01.21 03:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007.02.12 13:38:04 | 000,355,096 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R) SRV - [2007.01.04 19:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Stopped] -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr) SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - [2012.02.15 19:58:59 | 000,137,416 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011.10.11 14:00:01 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.10.11 14:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2011.03.20 21:56:10 | 000,016,694 | ---- | M] (PalmSource, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PalmUSBD.sys -- (PalmUSBD) DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010.03.30 10:51:50 | 000,335,224 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avmnwim.sys -- (NWIM) DRV - [2010.03.18 10:02:08 | 000,037,328 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt) DRV - [2010.03.18 10:01:52 | 000,038,864 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt) DRV - [2010.03.18 10:01:44 | 000,010,448 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidEqd.sys -- (LHidEqd) DRV - [2010.03.18 10:01:36 | 000,040,912 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LEqdUsb.sys -- (LEqdUsb) DRV - [2010.01.26 15:40:07 | 000,950,848 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\tdrpm124.sys -- (tdrpman124) Acronis Try&Decide and Restore Points filter (build 124) DRV - [2010.01.26 15:40:03 | 000,539,104 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\timntr.sys -- (timounter) DRV - [2010.01.26 15:40:03 | 000,044,704 | ---- | M] (Acronis) [File_System | Auto | Stopped] -- C:\Windows\System32\drivers\tifsfilt.sys -- (tifsfilter) DRV - [2010.01.26 15:39:57 | 000,134,272 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\snman378.sys -- (snapman378) Acronis Snapshots Manager (Build 378) DRV - [2009.02.05 18:39:08 | 000,017,064 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SiWinAcc.sys -- (SiFilter) DRV - [2009.02.05 18:39:00 | 000,012,200 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\SiRemFil.sys -- (SiRemFil) DRV - [2009.02.05 18:38:24 | 000,212,520 | ---- | M] (Silicon Image, Inc) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\Si3531.sys -- (Si3531) DRV - [2009.01.08 09:42:54 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk) DRV - [2008.02.22 15:33:02 | 000,114,304 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm) DRV - [2008.02.22 15:33:02 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl) DRV - [2008.02.22 15:33:00 | 000,087,936 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus) SAMSUNG USB Composite Device driver (WDM) DRV - [2007.12.19 18:45:00 | 000,170,000 | ---- | M] (AMD Technologies Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\ahcix86s.sys -- (ahcix86s) DRV - [2007.10.31 11:23:00 | 000,124,960 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvrd32.sys -- (nvrd32) DRV - [2007.10.31 11:23:00 | 000,115,744 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32) DRV - [2007.10.11 23:13:16 | 003,155,456 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2007.09.29 13:30:52 | 000,065,024 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID) DRV - [2007.05.04 11:21:48 | 000,208,896 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\iaNvStor.sys -- (iaNvStor) Intel(R) DRV - [2007.04.30 13:42:14 | 000,081,408 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2007.02.25 06:14:00 | 002,216,448 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R) DRV - [2007.01.08 13:38:30 | 000,046,592 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir) DRV - [2006.11.28 21:46:24 | 000,028,224 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PDNMp50.sys -- (PDNMp50) DRV - [2006.11.28 21:46:22 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\PDNSp50.sys -- (PDNSp50) DRV - [2006.11.22 17:35:00 | 000,982,272 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\smserial.sys -- (smserial) DRV - [2006.11.10 14:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\afc.sys -- (Afc) DRV - [2006.07.31 06:44:00 | 000,580,992 | ---- | M] (Omnivision Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ov550i.sys -- (APL531) DRV - [2004.07.25 06:59:16 | 000,018,560 | R--- | M] (DiBcom) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\UDTTload.sys -- (UDTTload) DRV - [2004.07.25 06:59:16 | 000,015,744 | R--- | M] (DiBcom) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\UDTTcap.sys -- (UDTTUSB) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.netcologne.de IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.netcologne.de IE - HKLM\..\URLSearchHook: {bc04b34e-5dd8-465a-a5e0-86f7c11bc009} - C:\Programme\Games_Bar_1\tbGam1.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2452474 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.n-tv.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\..\URLSearchHook: {bc04b34e-5dd8-465a-a5e0-86f7c11bc009} - C:\Programme\Games_Bar_1\tbGam1.dll (Conduit Ltd.) IE - HKCU\..\SearchScopes,DefaultScope = {8064DBA7-F251-4468-8A19-1BB029E4A25B} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 IE - HKCU\..\SearchScopes\{8064DBA7-F251-4468-8A19-1BB029E4A25B}: "URL" = hxxp://www.google.de/search?q={searchTerms}&rlz=1I7GZAZ_deDE364 IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2452474 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "www.google.de" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\****\AppData\Roaming\06014 [2012.03.16 23:25:15 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.16 23:36:09 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.09.04 19:04:15 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\****\AppData\Roaming\06014 [2012.03.16 23:25:15 | 000,000,000 | ---D | M] [2010.01.28 21:40:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\****\AppData\Roaming\mozilla\Extensions [2011.06.29 11:17:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\****\AppData\Roaming\mozilla\Firefox\Profiles\tf0chbex.default\extensions [2010.05.11 21:05:51 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\****\AppData\Roaming\mozilla\Firefox\Profiles\tf0chbex.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2012.01.13 20:14:46 | 000,000,000 | ---D | M] ("Avira SearchFree Toolbar plus Web Protection") -- C:\Users\****\AppData\Roaming\mozilla\Firefox\Profiles\tf0chbex.default\extensions\toolbar@ask.com [2012.03.16 23:36:10 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions File not found (No name found) -- C:\USERS\RüDIGER LOTZE\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\TF0CHBEX.DEFAULT\EXTENSIONS\TOOLBAR@ASK.COM [2012.03.16 23:36:09 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2011.10.03 05:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2012.03.16 23:36:07 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.03.16 23:36:07 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2012.03.16 23:36:07 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2012.03.16 23:36:07 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2012.03.16 23:36:07 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2012.03.16 23:36:07 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Oryte Games 1 Toolbar) - {bc04b34e-5dd8-465a-a5e0-86f7c11bc009} - C:\Programme\Games_Bar_1\tbGam1.dll (Conduit Ltd.) O2 - BHO: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (Oryte Games 1 Toolbar) - {bc04b34e-5dd8-465a-a5e0-86f7c11bc009} - C:\Programme\Games_Bar_1\tbGam1.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKCU\..\Toolbar\WebBrowser: (Oryte Games 1 Toolbar) - {BC04B34E-5DD8-465A-A5E0-86F7C11BC009} - C:\Programme\Games_Bar_1\tbGam1.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Avira SearchFree Toolbar plus Web Protection) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Programme\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis) O4 - HKLM..\Run: [AcronisTimounterMonitor] C:\TimounterMonitor.exe (Acronis) O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe ({StringFileInfo_CompanyName}) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.) O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.) O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation) O4 - HKLM..\Run: [IaNvSrv] C:\Programme\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe (Intel Corporation) O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [NPSStartup] File not found O4 - HKLM..\Run: [OSD] C:\Programme\C&E\OSD\osd.exe (C&E) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [SMSERIAL] C:\Programme\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.) O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe () O4 - HKLM..\Run: [TrueImageMonitor.exe] C:\TrueImageMonitor.exe (Acronis) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKCU..\Run: [Userinit] C:\Users\****\AppData\Roaming\appconf32.exe () O4 - HKCU..\Run: [vasja] C:\Users\****\AppData\Local\Temp\mor.exe (The tale ofHyboria on a quest to avenge the murder of his father and the slaughter) O4 - Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DOGS DIARY.lnk = C:\Programme\DOGS DIARY\DOGS DIARY.exe () O4 - Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk = C:\Programme\Common Files\LogiShrd\eReg\SetPoint\eReg.exe (Leader Technologies/Logitech) O4 - Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) O4 - Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\palmOne Registration.lnk = C:\Programme\palmOne\register.exe (palmOne/Leader Technologies) O4 - Startup: C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk = File not found O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O13 - gopher Prefix: missing O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab (20-20 3D Viewer for IKEA) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Users\****\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\****\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - D:\autoexec.bat~GVAMQ7G9 -- [ NTFS ] O33 - MountPoints2\{0f181b39-fb07-11df-86c1-00030d82ccf3}\Shell - "" = AutoRun O33 - MountPoints2\{0f181b39-fb07-11df-86c1-00030d82ccf3}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\Start.hta O33 - MountPoints2\{a8aaec6d-6c74-11df-a0d4-00030d82ccf3}\Shell - "" = AutoRun O33 - MountPoints2\{a8aaec6d-6c74-11df-a0d4-00030d82ccf3}\Shell\AutoRun\command - "" = F:\LaunchU3.exe O33 - MountPoints2\{ec06a02b-8200-11df-9989-00030d82ccf3}\Shell - "" = AutoRun O33 - MountPoints2\{ec06a02b-8200-11df-9989-00030d82ccf3}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2012.03.17 01:03:09 | 000,594,944 | ---- | C] (OldTimer Tools) -- C:\Users\****\Desktop\OTL.exe [2012.03.16 23:25:15 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\06014 [2012.03.16 23:24:49 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\xmldm [2012.03.16 23:24:49 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\kock [2012.03.16 17:00:15 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\Gooqs [2012.03.16 17:00:15 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\Cemuu [2012.03.16 16:58:34 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Roaming\Atrure [2012.03.14 11:44:46 | 002,044,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys [2012.03.14 11:44:45 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10warp.dll [2012.03.14 11:44:45 | 001,068,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\DWrite.dll [2012.03.14 11:44:45 | 000,683,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d2d1.dll [2012.03.14 11:44:45 | 000,219,648 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1core.dll [2012.03.14 11:44:45 | 000,160,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3d10_1.dll [2012.03.14 11:44:38 | 000,613,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpencom.dll [2012.03.04 18:38:48 | 000,000,000 | ---D | C] -- C:\Users\****\Desktop\Brother MFC-7840W FAQs & Störungssuche Deutschland-Dateien [2012.02.26 20:38:25 | 000,000,000 | ---D | C] -- C:\Users\****\AppData\Local\.elfohilfe [1 C:\Users\****\AppData\Roaming\*.tmp files -> C:\Users\****\AppData\Roaming\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.03.17 01:16:00 | 000,002,631 | ---- | M] () -- C:\Users\****\Desktop\Microsoft Office Word 2007.lnk [2012.03.17 01:01:42 | 000,594,944 | ---- | M] (OldTimer Tools) -- C:\Users\****\Desktop\OTL.exe [2012.03.17 00:56:43 | 000,001,356 | ---- | M] () -- C:\Users\****\AppData\Local\d3d9caps.dat [2012.03.17 00:43:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.03.17 00:41:45 | 000,003,840 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2012.03.17 00:41:45 | 000,003,840 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2012.03.17 00:41:45 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat [2012.03.17 00:33:00 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012.03.17 00:24:42 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012.03.17 00:24:32 | 000,001,872 | ---- | M] () -- C:\Users\****\Desktop\NetCologne DSL-Verbindungsmonitor.lnk [2012.03.17 00:24:11 | 000,000,808 | ---- | M] () -- C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DOGS DIARY.lnk [2012.03.16 23:36:01 | 000,000,016 | ---- | M] () -- C:\Users\****\AppData\Roaming\blckdom.res [2012.03.16 23:25:22 | 000,005,624 | ---- | M] () -- C:\Users\****\AppData\Roaming\BAcroIEHelpe.dll [2012.03.16 23:25:21 | 000,390,648 | ---- | M] () -- C:\Users\****\AppData\Roaming\AcroIEHelpe.dll [2012.03.16 20:03:08 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.03.16 20:03:07 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.03.16 20:03:07 | 000,126,454 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.03.16 20:03:07 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.03.15 21:24:13 | 000,002,633 | ---- | M] () -- C:\Users\****\Desktop\Microsoft Office Excel 2007.lnk [2012.03.15 10:30:07 | 000,315,456 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.03.14 20:31:47 | 000,153,600 | ---- | M] () -- C:\Users\****\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.03.14 11:35:41 | 000,000,897 | ---- | M] () -- C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\palmOne Registration.lnk [2012.03.04 18:38:48 | 000,047,609 | ---- | M] () -- C:\Users\****\Desktop\Brother MFC-7840W FAQs & Störungssuche Deutschland.htm [2012.02.27 20:08:59 | 000,000,432 | ---- | M] () -- C:\Windows\BRWMARK.INI [2012.02.26 20:34:11 | 000,001,022 | ---- | M] () -- C:\Users\Public\Desktop\ElsterFormular.lnk [2012.02.25 16:10:06 | 000,016,400 | ---- | M] (Logitech, Inc.) -- C:\Windows\System32\drivers\LNonPnP.sys [2012.02.23 09:18:36 | 000,237,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe [1 C:\Users\****\AppData\Roaming\*.tmp files -> C:\Users\****\AppData\Roaming\*.tmp -> ] [1 C:\*.tmp files -> C:\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.03.16 23:25:22 | 000,005,624 | ---- | C] () -- C:\Users\****\AppData\Roaming\BAcroIEHelpe.dll [2012.03.16 23:25:21 | 000,390,648 | ---- | C] () -- C:\Users\****\AppData\Roaming\AcroIEHelpe.dll [2012.03.16 23:24:58 | 000,000,016 | ---- | C] () -- C:\Users\****\AppData\Roaming\blckdom.res [2012.03.04 18:38:48 | 000,047,609 | ---- | C] () -- C:\Users\****\Desktop\Brother MFC-7840W FAQs & Störungssuche Deutschland.htm [2012.01.21 22:02:19 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll [2010.12.26 17:44:04 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll [2010.09.24 19:47:29 | 000,000,107 | ---- | C] () -- C:\Windows\VSWizard.ini [2010.09.14 21:44:03 | 000,000,015 | ---- | C] () -- C:\Windows\WDZ2.ini [2010.03.25 20:57:09 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat < End of report > Extras.txt:OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 17.03.2012 01:44:36 - Run 2
OTL by OldTimer - Version 3.2.37.1 Folder = C:\Users\****\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 2,33 Gb Available Physical Memory | 77,84% Memory free
6,19 Gb Paging File | 5,72 Gb Available in Paging File | 92,36% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 298,09 Gb Total Space | 152,21 Gb Free Space | 51,06% Space Free | Partition Type: NTFS
Drive D: | 298,09 Gb Total Space | 200,65 Gb Free Space | 67,31% Space Free | Partition Type: NTFS
Drive F: | 149,01 Gb Total Space | 77,54 Gb Free Space | 52,03% Space Free | Partition Type: FAT32
Computer Name: ****-PC | User Name: **** | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [CEWE FOTOSCHAU] -- "C:\Program Files\dm\dm Fotowelt\CEWE FOTOSCHAU.exe" -d "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [dm Fotowelt] -- "C:\Program Files\dm\dm Fotowelt\dm Fotowelt.exe" "%1" ()
Directory [dm-Fotowelt] -- "C:\Program Files\dm\dm Fotowelt\dm-Fotowelt.exe" "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Foto Paradies] -- "C:\Program Files\dm\dm Fotowelt\Foto Paradies.exe" "%1" ()
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1B5A00EC-5D45-48AB-AA10-38ADF938AD3E}" = rport=139 | protocol=6 | dir=out | app=system |
"{30986333-9E9B-4667-A1F7-0250D89A0DA6}" = lport=139 | protocol=6 | dir=in | app=system |
"{4A390B90-F2A8-4C3C-BBA3-0776D77D7AB5}" = lport=137 | protocol=17 | dir=in | app=system |
"{573A6E20-3D07-4042-8EDA-FBD432C42EE3}" = lport=445 | protocol=6 | dir=in | app=system |
"{6B08F9EF-73F4-404D-9C7F-9D010F6298B1}" = rport=445 | protocol=6 | dir=out | app=system |
"{811B3BD7-9411-482D-BD8F-E2EA1ABC49FF}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{C3D99167-D13C-46F8-8F2E-5496544211CF}" = lport=138 | protocol=17 | dir=in | app=system |
"{C7BCA6E6-27C1-4FC5-B204-17570CD9C038}" = rport=138 | protocol=17 | dir=out | app=system |
"{E39EB8AD-97E6-4D4C-8821-F30B53ADD175}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{FD0E4393-AE75-47FE-A8F3-11C7117DFC9D}" = rport=137 | protocol=17 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0E02D9C8-1B1D-4AD7-9F4D-C369495ADECE}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |
"{296FDBA7-B2C3-4E2C-80BD-82CE830CBB1E}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsasvr.exe |
"{331F4829-1A15-4309-A723-3948DFAA162B}" = protocol=17 | dir=in | app=c:\program files\starmoney 7.0 apoedition\app\starmoney.exe |
"{34720651-29A3-49F6-8B75-99B4E6890978}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{405F6CE4-5BC0-4784-8B2F-EF721207E438}" = protocol=17 | dir=in | app=c:\program files\starmoney 7.0 apoedition\ouservice\starmoneyonlineupdate.exe |
"{4EF33936-1D2E-46A2-A952-08DE9BBAE0A6}" = protocol=6 | dir=in | app=c:\program files\starmoney 7.0 apoedition\app\starmoney.exe |
"{4EFCE803-272D-4BD6-B61D-D28FAF403C6A}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{57F527E3-FD20-440B-8566-A61466EB4A1F}" = protocol=6 | dir=in | app=c:\program files\starmoney 7.0 apoedition\ouservice\starmoneyonlineupdate.exe |
"{588CBC95-8F62-42AC-B1C2-C4E2BC4E4B9C}" = protocol=6 | dir=in | app=c:\program files\starmoney 8.0 apoedition\app\starmoney.exe |
"{5CAA50BA-10F7-4C1B-B84C-805AC012868B}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{5EFFC508-89BC-4810-9731-0781CC311F7D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{63877622-454E-4F05-B571-E08B6D50992B}" = protocol=6 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |
"{81F4ED26-85A4-4881-BBB1-2756F86C58AF}" = protocol=17 | dir=in | app=c:\program files\starmoney 8.0 apoedition\app\starmoney.exe |
"{8C18201B-FE87-476A-BD04-FECBC8A00FFB}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{8E43BE2A-76FA-433E-93A4-E9169A37AEF8}" = protocol=6 | dir=in | app=c:\program files\starmoney 8.0 apoedition\ouservice\starmoneyonlineupdate.exe |
"{AB472210-AB72-4FB0-A1F0-03700CF036AE}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{B46C9254-1E32-4999-86B8-7A9A77F6C81A}" = protocol=17 | dir=in | app=c:\program files\samsung\samsung new pc studio\npsvsvr.exe |
"{D34041B4-D205-4BDB-9988-7A0A6F02CA3A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{DC89B5E6-B2B3-4B2B-AC29-DD00FB2A18E7}" = protocol=17 | dir=in | app=c:\program files\starmoney 8.0 apoedition\ouservice\starmoneyonlineupdate.exe |
"TCP Query User{094C1892-0FE9-44E1-B49D-596B29253BEB}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{2E76513B-8D44-4313-A330-D5DE30744D04}C:\program files\quicktime\quicktimeplayer.exe" = protocol=6 | dir=in | app=c:\program files\quicktime\quicktimeplayer.exe |
"TCP Query User{8B372522-C525-4503-B557-7594C9508943}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"TCP Query User{8FA0DCD7-01E4-44D0-A3B2-1E5F58C3032F}C:\program files\intervideo\dvd8\windvd.exe" = protocol=6 | dir=in | app=c:\program files\intervideo\dvd8\windvd.exe |
"TCP Query User{D37F1B71-97B0-49A4-A6A5-254FE8B34FEF}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{26E773DC-2A41-4641-914E-6FEBF64F6444}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{3E361896-5910-4776-9B81-9DD2132FC0CA}C:\program files\intervideo\dvd8\windvd.exe" = protocol=17 | dir=in | app=c:\program files\intervideo\dvd8\windvd.exe |
"UDP Query User{8E0D46EE-0E1B-4BF8-A1C6-1773E24862F4}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"UDP Query User{DD347A0C-EEF9-4EFE-B0B3-685A68D27E6D}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{F80D5D19-DC8E-4E4C-8EB0-EC0DAD6F0880}C:\program files\quicktime\quicktimeplayer.exe" = protocol=17 | dir=in | app=c:\program files\quicktime\quicktimeplayer.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{063E409E-3D7C-4A4A-95AB-2F124B9224B3}" = ArcSoft PhotoImpression 6
"{09298F26-A95C-31E2-9D95-2C60F586F075}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1CD220E7-1512-A5E1-327F-9607587B75AD}" = Catalyst Control Center Graphics Light
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = InterVideo WinDVD 8
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216023FF}" = Java(TM) 6 Update 29
"{2BC2781A-F7F6-452E-95EB-018A522F1B2C}" = PaperPort Image Printer
"{37C8899D-FD70-481F-94AA-1F1B08765E22}" = Acronis*True*Image*Home
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E5948BC-A071-3C35-7DC4-31F5F293F35B}" = Catalyst Control Center Graphics Full New
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{43EA3C14-C1F7-A093-1F4D-362A09F9A63B}" = CCC Help German
"{462F002C-0A03-6C5F-3475-228396D8F2AB}" = ccc-core-static
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{46E1B1F2-A279-4356-9B17-029F9CC72EAE}" = Brother MFL-Pro Suite
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5DC36978-AB9A-4A23-9C12-D90D2BB781B7}" = AVM FRITZ!Fernzugang
"{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}" = Apple Application Support
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B566EFE-DC1D-471F-93DD-84832663F140}" = OVT Scanner X86
"{6BB19E5E-2AD7-B464-3B80-FB0CD8C504FB}" = Catalyst Control Center Graphics Full Existing
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7A8FF745-BBC5-482B-88E4-18D3178249A9}" = ScanSoft PaperPort 11
"{7C379BEF-4E12-3224-B2E8-513363B99181}" = ccc-utility
"{837E620D-B93E-4D84-A753-BE1DBEB716B1}" = StarMoney
"{8690891C-DD95-E081-CE42-71C64761AFA3}" = DOGS DIARY
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{86F4B795-EA3D-48BD-ADFA-DA44B39059F9}" = StarMoney
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A0D5D23-382F-40F4-9318-63945C24592C}" = StarMoney
"{8AD67572-0AE2-0CAC-CD8B-17FBAC973901}" = ATI Catalyst Install Manager
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{95ED7549-7C66-A618-3100-B6999F6A79A4}" = Catalyst Control Center Localization German
"{960EED1D-8F37-9EF5-C2F2-19C19983658B}" = Catalyst Control Center Core Implementation
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BBB98B8-1BAD-4771-A244-06CCB2A2CBA7}" = StarMoney 7.0 apoEdition
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{ABC80104-036E-6193-566F-4308420A4005}" = Catalyst Control Center Graphics Previews Vista
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.1 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{B2390904-74BD-48AA-B2CC-6612F8D46379}" = GameShadow
"{B4FEA924-630D-11D4-B78E-005004566E4D}" = ViewSonic Monitor Drivers
"{BD312050-9D98-4F71-ADCD-25EC037C05FD}" = StarMoney
"{C19DBE5E-712E-4F02-8380-ECEDD951B374}" = VisionDTV
"{C9E14402-3631-4182-B377-6B0DFB1C0339}" = QuickTime
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240C1}" = WinZip 15.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D34D82E0-4600-407B-9478-8506C1DD1031}" = Nero 7 Essentials
"{D996B77B-3EFD-4AC6-8C11-C81C7454DB93}" = StarMoney 6.0 apoEdition
"{DEE7AE5E-A8D1-05CF-5383-E5DC68486A54}" = Skins
"{E0534F04-ACC4-46DB-BE92-32575929A1AD}" = Lesefix v1.2
"{E948B551-08DB-4163-8995-8C43B03D1B19}" = maxdome Download Manager 4.1.300.78
"{EB863CFD-6889-47B0-9D79-492DE0D07EE7}" = OSDInstall
"{F04CAFE3-D52F-4EFC-A1E8-316BD4C525D6}" = NTI Shadow
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F8A9F4D7-4EC8-4E28-9B01-4CF74C812BF2}" = StarMoney
"{FC76C9C0-B4BF-463E-A99B-2DFEA769D0E9}" = StarMoney 8.0 apoEdition
"{FF8157AA-F640-45BD-B7C2-BAA1016B267A}" = palmOne
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"com.adobe.example.diary.AC2D34E49418B393981766FA31245F1D30E4A56D.1" = DOGS DIARY
"dm Fotowelt" = dm Fotowelt
"dm-Fotowelt" = dm-Fotowelt
"ElsterFormular 13.0.0.8086u" = ElsterFormular
"ElsterFormular für Privatanwender 12.1.0.6164p" = ElsterFormular für Privatanwender
"Foto Paradies" = Foto Paradies
"Games_Bar_1 Toolbar" = Games_Bar_1 Toolbar
"GeoGebra" = GeoGebra
"GMX ProfiFax" = GMX ProfiFax
"HeymannsPatG" = Schulte: Patentgesetz mit EPÜ - 7. Auflage 2005
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = InterVideo WinDVD 8
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)
"NetCologne" = NetCologne-Installationsdateien entfernen
"OVT Scanner" = Uninstall OVT Scanner
"RollerCoaster Tycoon 3_is1" = RollerCoaster Tycoon 3
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"SMSERIAL" = Motorola SM56 Data Fax Modem
"SP6" = Logitech SetPoint 6.15
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 03.04.2011 09:58:53 | Computer Name = RüdigerLotze-PC | Source = WinMgmt | ID = 10
Description =
Error - 04.04.2011 01:23:56 | Computer Name = ****-PC | Source = WinMgmt | ID = 10
Description =
Error - 04.04.2011 13:43:09 | Computer Name = ****-PC | Source = WinMgmt | ID = 10
Description =
Error - 05.04.2011 01:06:09 | Computer Name = ****-PC | Source = WinMgmt | ID = 10
Description =
Error - 05.04.2011 01:32:33 | Computer Name = ****-PC | Source = EventSystem | ID = 4621
Description =
Error - 05.04.2011 11:37:56 | Computer Name = ****-PC | Source = WinMgmt | ID = 10
Description =
Error - 05.04.2011 17:10:12 | Computer Name = ****-PC | Source = EventSystem | ID = 4621
Description =
Error - 06.04.2011 14:09:12 | Computer Name = ****-PC | Source = WinMgmt | ID = 10
Description =
Error - 07.04.2011 13:27:03 | Computer Name = ****-PC | Source = WinMgmt | ID = 10
Description =
Error - 07.04.2011 17:22:08 | Computer Name = ****-PC | Source = EventSystem | ID = 4621
Description =
[ OSession Events ]
Error - 23.07.2010 08:51:30 | Computer Name = ****-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:
12.0.6535.5002, Microsoft Office Version: 12.0.6425.1000. This session lasted 187
seconds with 60 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 16.03.2012 19:12:05 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 16.03.2012 19:12:14 | Computer Name = ****-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001
Description =
Error - 16.03.2012 19:14:18 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7009
Description =
Error - 16.03.2012 19:41:17 | Computer Name = ****-PC | Source = DCOM | ID = 10010
Description =
Error - 16.03.2012 19:43:56 | Computer Name = ****-PC | Source = DCOM | ID = 10005
Description =
Error - 16.03.2012 19:44:04 | Computer Name = ****-PC | Source = DCOM | ID = 10005
Description =
Error - 16.03.2012 19:44:27 | Computer Name = ****-PC | Source = DCOM | ID = 10005
Description =
Error - 16.03.2012 19:44:28 | Computer Name = ****-PC | Source = DCOM | ID = 10005
Description =
Error - 16.03.2012 19:45:04 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7001
Description =
Error - 16.03.2012 19:45:04 | Computer Name = ****-PC | Source = Service Control Manager | ID = 7026
Description =
< End of report >
Was kommt jetzt als nächstes? Vielen Dank für Eure Hilfe im voraus!!!! |
|
17.03.2012, 16:07
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Weißer Bildschirm mit Ucash Zahlungsaufforderung 100 €Zitat:
Bitte nun routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen! Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Außerdem müssen alle Funde entfernt werden. Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! ESET Online Scanner
Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
__________________ |
|
21.03.2012, 13:48
| #3 |
| | Weißer Bildschirm mit Ucash Zahlungsaufforderung 100 € Hallo Arne,
__________________Zunächst einmal tausend Dank für Euren tollen Einsatz. ich bewundere das! So, wie es einem anderen Nutzer auch schon mal ergangen ist, habe ich die Datei MOR.EXE in meinem temp-Ordner gefunden und gelöscht. Danach konnte ich Windows wieder normal starten ohne weitere Probleme. Anschließend bin ich noch zum letzten Systemwiederherstellungspunkt zurückgegangen. Weiterhin habe ich noch Spybot Search & Destroy installiert und über mein System laufen lassen ohne Meldungen über Schadsoftware. Auch Avira hat nichts angezeigt außer zwei Dateien, die aber offenbar zu meinen ATI-Treibern gehören und im Netz als nicht bösartig bezeichnet werden. Ich bin natürlich nicht so naiv zu glauben, das einfache Löschen der Datei hätte jetzt alle Probleme behoben. Sollte ich trotzdem nochmal MBAM/ESET laufen lassen? Viele Grüße Rudi |
|
21.03.2012, 16:12
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Weißer Bildschirm mit Ucash Zahlungsaufforderung 100 €Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
| Themen zu Weißer Bildschirm mit Ucash Zahlungsaufforderung 100 € |
| antivir, autorun, avira, avira searchfree toolbar, bho, bildschirm, conduit, device driver, error, firefox, flash player, format, google earth, home, iexplore.exe, install.exe, logfile, microsoft office word, mor.exe, netzwerk, object, office 2007, plug-in, realtek, registry, rundll, scan, searchscopes, security, senden, software, starmoney, starten, tcp, version=1.0, vista, windows, zahlung |
Linear-Darstellung
