| |
| |||||||
Log-Analyse und Auswertung: Firefox leitet um will "Update" herunterladenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
22.03.2011, 11:16
| #1 |
| |  Firefox leitet um will "Update" herunterladen Hi Leute, Habe zwar in Google und auf euerem Board Hinweise gefunden jedoch nichts was mir weiterhelfen konnte. Firefox leitet mich machmal -wenn ich auf irgendwelche Links klicke- auf eine andere Seite um "zamanuxa.co.cc". Dort wird mir "firefox-like" gesagt, dass es sich hiebei um keine vertrauenswürdige Seite handelt (roter Hintergrund) und ich mein Firefox updaten soll. Die Datei wird dann von dieser Seite bereitgestellt und soll dort runtergeladen werden. Avira findet nichts. * Lade Tralala von File-Upload.net - Tralala.exe * Klick auf Download (rechts in der Mitte) und speichere es auf den Desktop * Doppelklick auf Tralala.exe * Der Reiter Rootkit oben ist schon angewählt * Drücke Scan, Der Vorgang kann je nach System 3 - 10min dauern * nach Beendigung des Scan, drücke "Copy" * nun kannst Du das Ergebnis hier einfügen. Hier die Log File: GMER Logfile: Code:
ATTFilter GMER 1.0.14.14536 - hxxp://www.gmer.net
Rootkit scan 2011-03-22 11:16:21
Windows 6.1.7600
---- System - GMER 1.0.14 ----
INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8302EAF8
INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8302E104
INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8302E3F4
INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83016634
INT 0xD2 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 83016898
INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8302E1DC
INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8302E958
INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8302E6F8
INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8302EF2C
INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8302F1A8
---- Kernel code sections - GMER 1.0.14 ----
.text ntkrnlpa.exe!ZwSaveKeyEx + 13BD 82C47589 1 Byte [ 06 ]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A4 82C6C094 17 Bytes [ BA, F0, 07, 73, 09, 0F, 22, ... ]
.text peauth.sys 9A56BC9D 28 Bytes [ 5E, ED, F7, E7, 8E, 09, FC, ... ]
.text peauth.sys 9A56BCC1 28 Bytes [ 5E, ED, F7, E7, 8E, 09, FC, ... ]
---- User code sections - GMER 1.0.14 ----
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[1936] USER32.dll!TrackPopupMenu 76654B3B 5 Bytes JMP 64876373 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\firefox.exe[2608] ntdll.dll!LdrLoadDll 7726F5B5 5 Bytes JMP 012013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
---- User IAT/EAT - GMER 1.0.14 ----
IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\Explorer.EXE [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\system32\ole32.dll [msvcrt.dll!free] [670211EB] C:\Windows\AppPatch\AcSpecfc.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[1044] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2176] @ C:\Windows\explorer.exe [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2176] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2176] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2176] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2176] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2176] @ C:\Windows\system32\ole32.dll [msvcrt.dll!free] [670211EB] C:\Windows\AppPatch\AcSpecfc.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2176] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2176] @ C:\Windows\system32\wininet.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\explorer.exe[2176] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\System32\rundll32.exe[2472] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\System32\rundll32.exe[2472] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\System32\rundll32.exe[2472] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\System32\rundll32.exe[2472] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[2712] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[2712] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[2712] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[2712] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[2712] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[2712] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe[2712] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\System32\rundll32.exe[2996] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\System32\rundll32.exe[2996] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\System32\rundll32.exe[2996] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Windows\System32\rundll32.exe[2996] @ C:\Windows\system32\advapi32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Users\Ursula\Desktop\Tralala.exe[3956] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Users\Ursula\Desktop\Tralala.exe[3956] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Users\Ursula\Desktop\Tralala.exe[3956] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Users\Ursula\Desktop\Tralala.exe[3956] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Users\Ursula\Desktop\Tralala.exe[3956] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT C:\Users\Ursula\Desktop\Tralala.exe[3956] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [752B5E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
---- Devices - GMER 1.0.14 ----
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
Device \Driver\BTHUSB \Device\00000073 bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
Device \Driver\BTHUSB \Device\00000075 bthport.sys (Bluetooth-Bustreiber/Microsoft Corporation)
Device \Driver\ACPI_HAL \Device\0000004a halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
---- Registry - GMER 1.0.14 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001dd9e6ab46
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001dd9e6ab46
---- EOF - GMER 1.0.14 ----
Danke für die Hilfe... |
|
22.03.2011, 12:11
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Firefox leitet um will "Update" herunterladen Hallo und
__________________ Bitte routinemäßig einen Vollscan mit Malwarebytes machen und Log posten. Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss! Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten! Danach OTL: Systemscan mit OTL Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
__________________ |
|
22.03.2011, 13:44
| #3 |
| | Firefox leitet um will "Update" herunterladen Malwarebytes' Anti-Malware 1.50.1.1100
__________________www.malwarebytes.org Datenbank Version: 6130 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 22.03.2011 13:43:33 mbam-log-2011-03-22 (13-43-33).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|) Durchsuchte Objekte: 389650 Laufzeit: 1 Stunde(n), 54 Minute(n), 8 Sekunde(n) Infizierte Speicherprozesse: 0 Infizierte Speichermodule: 1 Infizierte Registrierungsschlüssel: 0 Infizierte Registrierungswerte: 3 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 2 Infizierte Speicherprozesse: (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: c:\Users\Ursula\AppData\Local\Temp\wvtrop.dll (Trojan.Agent) -> Delete on reboot. Infizierte Registrierungsschlüssel: (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xxyawtaudio (Trojan.Agent) -> Value: xxyawtaudio -> Quarantined and deleted successfully. HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\efcaxxsys (Trojan.Vundo) -> Value: efcaxxsys -> Quarantined and deleted successfully. HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\efcaxxsys (Trojan.Vundo) -> Value: efcaxxsys -> Quarantined and deleted successfully. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\Users\Ursula\downloads\removewat v2.2.5.2\removewat.exe (HackTool.Wpakill) -> Quarantined and deleted successfully. c:\Users\Ursula\AppData\Local\Temp\wvtrop.dll (Trojan.Agent) -> Delete on reboot. Danke, lg |
|
22.03.2011, 13:55
| #4 |
| | Firefox leitet um will "Update" herunterladen OTL Logfile: Code:
ATTFilter OTL logfile created on: 22.03.2011 13:49:26 - Run 1 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Ursula\Desktop Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 60,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 77,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 99,18 Gb Total Space | 22,05 Gb Free Space | 22,24% Space Free | Partition Type: NTFS Drive D: | 111,79 Gb Total Space | 100,70 Gb Free Space | 90,08% Space Free | Partition Type: NTFS Drive E: | 10,00 Gb Total Space | 5,96 Gb Free Space | 59,58% Space Free | Partition Type: NTFS Computer Name: URSULA-PC | User Name: Ursula | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Ursula\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe (Sony Corporation) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation) PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation) PRC - C:\Programme\Windows Sidebar\sidebar.exe (Microsoft Corporation) PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation) PRC - C:\Windows\System32\audiodg.exe (Microsoft Corporation) PRC - C:\Programme\Spamihilator\spamihilator.exe (Michel Krämer) PRC - C:\Programme\3DataManager\WTGService.exe () PRC - C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG) PRC - C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) PRC - C:\Windows\OEM02Mon.exe (Creative Technology Ltd.) ========== Modules (SafeList) ========== MOD - C:\Users\Ursula\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation) SRV - (Sony SCSI Helper Service) -- C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe (Sony Corporation) SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation) SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (WTGService) -- C:\Programme\3DataManager\WTGService.exe () SRV - (OpenVPNService) -- C:\Programme\OpenVPN\bin\openvpnserv.exe () ========== Driver Services (SafeList) ========== DRV - (gmer) -- C:\Windows\System32\drivers\gmer.sys (GMER) DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (Netaapl) -- C:\Windows\System32\drivers\netaapl.sys (Apple Inc.) DRV - (ewusbnet) -- C:\Windows\System32\drivers\ewusbnet.sys (Huawei Technologies Co., Ltd.) DRV - (hwusbdev) -- C:\Windows\System32\drivers\ewusbdev.sys (Huawei Technologies Co., Ltd.) DRV - (hwdatacard) -- C:\Windows\System32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (vmbus) -- C:\Windows\system32\DRIVERS\vmbus.sys (Microsoft Corporation) DRV - (storflt) -- C:\Windows\system32\DRIVERS\vmstorfl.sys (Microsoft Corporation) DRV - (storvsc) -- C:\Windows\system32\DRIVERS\storvsc.sys (Microsoft Corporation) DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation) DRV - (s3cap) -- C:\Windows\system32\DRIVERS\vms3cap.sys (Microsoft Corporation) DRV - (VMBusHID) -- C:\Windows\system32\DRIVERS\VMBusHID.sys (Microsoft Corporation) DRV - (netw5v32) Intel(R) -- C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation) DRV - (bcm4sbxp) -- C:\Windows\System32\drivers\bcm4sbxp.sys (Broadcom Corporation) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (OEM02Dev) -- C:\Windows\System32\drivers\OEM02Dev.sys (Creative Technology Ltd.) DRV - (tap0901) -- C:\Windows\System32\drivers\tap0901.sys (The OpenVPN Project) DRV - (OEM02Vfx) -- C:\Windows\System32\drivers\OEM02Vfx.sys (EyePower Games Pte. Ltd.) DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-at IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 69 37 9B 3C 91 A6 CB 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Wikipedia (de)" FF - prefs.js..browser.startup.homepage: "hxxp://www.google.at/" FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1 FF - prefs.js..extensions.enabledItems: 6 FF - prefs.js..extensions.enabledItems: 2 FF - prefs.js..extensions.enabledItems: 49 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.03.20 17:33:33 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.03.20 17:33:34 | 000,000,000 | ---D | M] [2009.11.15 18:57:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ursula\AppData\Roaming\mozilla\Extensions [2011.03.22 11:57:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ursula\AppData\Roaming\mozilla\Firefox\Profiles\mycaphmm.default\extensions [2009.11.15 20:17:51 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Users\Ursula\AppData\Roaming\mozilla\Firefox\Profiles\mycaphmm.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7} [2011.03.21 19:07:24 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.10.16 16:30:24 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.10.16 16:30:24 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.10.16 16:29:57 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2011.03.20 17:33:30 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2011.03.20 17:33:30 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2011.03.20 17:33:30 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2011.03.20 17:33:30 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2011.03.20 17:33:30 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] File not found O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NVHotkey] C:\Windows\System32\nvHotkey.dll (NVIDIA Corporation) O4 - HKLM..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe (Creative Technology Ltd.) O4 - HKLM..\Run: [Reader Library Launcher] C:\Programme\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe (Sony Corporation) O4 - HKLM..\Run: [Spamihilator] C:\Program Files\Spamihilator\spamihilator.exe (Michel Krämer) O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKCU..\Run: [EPSON Stylus SX200 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATIEFE.EXE (SEIKO EPSON CORPORATION) O4 - HKCU..\Run: [mlifccaudio] File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab (System Requirements Lab Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.186.211.21 195.34.133.21 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O30 - LSA: Authentication Packages - (gedbyy.dll) - File not found O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{164115cf-0cac-11df-9037-001dd9e6ab46}\Shell - "" = AutoRun O33 - MountPoints2\{164115cf-0cac-11df-9037-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1 O33 - MountPoints2\{164115d4-0cac-11df-9037-001dd9e6ab46}\Shell - "" = AutoRun O33 - MountPoints2\{164115d4-0cac-11df-9037-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1 O33 - MountPoints2\{280a6150-479b-11df-97ba-001dd9e6ab46}\Shell - "" = AutoRun O33 - MountPoints2\{280a6150-479b-11df-97ba-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1 O33 - MountPoints2\{280a615b-479b-11df-97ba-001dd9e6ab46}\Shell - "" = AutoRun O33 - MountPoints2\{280a615b-479b-11df-97ba-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{280a616d-479b-11df-97ba-001dd9e6ab46}\Shell - "" = AutoRun O33 - MountPoints2\{280a616d-479b-11df-97ba-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{280a6174-479b-11df-97ba-001e101f21c1}\Shell - "" = AutoRun O33 - MountPoints2\{280a6174-479b-11df-97ba-001e101f21c1}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{36c9cf47-47bb-11df-a02c-001dd9e6ab46}\Shell - "" = AutoRun O33 - MountPoints2\{36c9cf47-47bb-11df-a02c-001dd9e6ab46}\Shell\AutoRun\command - "" = H:\.\Autorun.exe AUTORUN=1 O33 - MountPoints2\{534ca659-497d-11df-9993-001e101faa49}\Shell - "" = AutoRun O33 - MountPoints2\{534ca659-497d-11df-9993-001e101faa49}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1 O33 - MountPoints2\{534fda29-8046-11df-a022-001dd9e6ab46}\Shell - "" = AutoRun O33 - MountPoints2\{534fda29-8046-11df-a022-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1 O33 - MountPoints2\{986aaf7f-d2c3-11df-8087-001dd9e6ab46}\Shell - "" = AutoRun O33 - MountPoints2\{986aaf7f-d2c3-11df-8087-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1 O33 - MountPoints2\{b1a44e7b-3db2-11df-bf4a-001dd9e6ab46}\Shell - "" = AutoRun O33 - MountPoints2\{b1a44e7b-3db2-11df-bf4a-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\AutoRun.exe O33 - MountPoints2\{b1a44e7d-3db2-11df-bf4a-001dd9e6ab46}\Shell - "" = AutoRun O33 - MountPoints2\{b1a44e7d-3db2-11df-bf4a-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1 O33 - MountPoints2\{b1a44e80-3db2-11df-bf4a-001dd9e6ab46}\Shell - "" = AutoRun O33 - MountPoints2\{b1a44e80-3db2-11df-bf4a-001dd9e6ab46}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1 O33 - MountPoints2\G\Shell - "" = AutoRun O33 - MountPoints2\G\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1 O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.03.22 13:44:46 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Ursula\Desktop\OTL.exe [2011.03.22 11:34:45 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Ursula\Desktop\mbam-setup.com [2011.03.22 11:25:37 | 000,000,000 | ---D | C] -- C:\Users\Ursula\AppData\Roaming\Malwarebytes [2011.03.22 11:25:14 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2011.03.22 11:25:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.03.22 11:25:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.03.22 11:25:10 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.03.22 11:25:10 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2011.03.22 10:55:33 | 000,085,969 | ---- | C] (GMER) -- C:\Windows\System32\drivers\gmer.sys [2011.03.21 18:57:48 | 000,000,000 | ---D | C] -- C:\Users\Ursula\AppData\Roaming\Avira [2011.03.21 14:01:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab [2011.03.21 13:19:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2011.03.21 13:19:09 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner [2011.03.21 12:55:26 | 000,000,000 | ---D | C] -- C:\VundoFix Backups [2011.03.21 12:51:39 | 000,000,000 | ---D | C] -- C:\Users\Ursula\AppData\Roaming\Enki Games [2011.03.21 12:50:09 | 000,000,000 | ---D | C] -- C:\Users\Ursula\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Reincarnations - Awakening [2011.03.21 12:49:40 | 000,000,000 | ---D | C] -- C:\Windows\Reincarnations - Awakening [2011.03.21 12:49:40 | 000,000,000 | ---D | C] -- C:\Programme\Reincarnations - Awakening [2011.03.21 12:45:21 | 000,000,000 | ---D | C] -- C:\Users\Ursula\AppData\Roaming\ERS Game Studios [2011.03.21 12:43:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\poigraem [2011.03.21 12:43:45 | 000,000,000 | ---D | C] -- C:\Users\Ursula\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\poigraem [2011.03.21 12:04:52 | 000,000,000 | ---D | C] -- C:\Users\Ursula\AppData\Roaming\Boomzap [2011.03.21 12:02:50 | 000,000,000 | ---D | C] -- C:\Programme\Games [2011.03.16 15:44:17 | 000,000,000 | ---D | C] -- C:\Programme\uTorrent [2011.03.16 15:43:42 | 000,000,000 | ---D | C] -- C:\Users\Ursula\AppData\Roaming\uTorrent [2011.03.10 12:20:53 | 000,850,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\sbe.dll [2011.03.10 12:20:53 | 000,642,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\CPFilters.dll [2011.03.10 12:20:53 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\EncDec.dll [2011.03.10 12:20:52 | 000,199,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mpg2splt.ax [2011.02.28 19:51:00 | 000,000,000 | ---D | C] -- C:\Users\Ursula\Documents\Farinelli Image Nero ========== Files - Modified Within 30 Days ========== [2011.03.22 13:47:05 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011.03.22 13:46:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.03.22 13:46:25 | 1609,072,640 | -HS- | M] () -- C:\hiberfil.sys [2011.03.22 13:44:55 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Ursula\Desktop\OTL.exe [2011.03.22 13:19:16 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011.03.22 11:24:50 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Ursula\Desktop\mbam-setup.com [2011.03.22 11:10:06 | 000,742,874 | ---- | M] () -- C:\Users\Ursula\Desktop\Load.exe [2011.03.22 10:55:46 | 000,000,250 | ---- | M] () -- C:\Users\Ursula\Desktop\gmer.ini [2011.03.22 10:55:33 | 000,884,736 | ---- | M] () -- C:\Windows\gmer.dll [2011.03.22 10:55:33 | 000,085,969 | ---- | M] (GMER) -- C:\Windows\System32\drivers\gmer.sys [2011.03.22 10:55:33 | 000,000,080 | ---- | M] () -- C:\Windows\gmer_uninstall.cmd [2011.03.22 10:55:32 | 000,300,544 | ---- | M] () -- C:\Users\Ursula\Desktop\Tralala.dll [2011.03.22 10:55:04 | 000,811,008 | ---- | M] () -- C:\Users\Ursula\Desktop\Tralala.exe [2011.03.22 10:55:04 | 000,811,008 | ---- | M] () -- C:\Windows\gmer.exe [2011.03.22 10:38:19 | 000,137,656 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2011.03.21 13:19:10 | 000,000,967 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.03.21 13:04:11 | 000,010,240 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.03.21 13:04:11 | 000,010,240 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.03.21 12:51:21 | 000,002,398 | ---- | M] () -- C:\Users\Ursula\Desktop\Reincarnations 2.lnk [2011.03.21 12:50:09 | 000,002,121 | ---- | M] () -- C:\Users\Ursula\Desktop\Reincarnations - Awakening.lnk [2011.03.21 12:43:45 | 000,001,572 | ---- | M] () -- C:\Users\Ursula\Desktop\Haunted Legends - The Queen of Spades CE.lnk [2011.03.21 12:04:37 | 000,001,889 | ---- | M] () -- C:\Users\Ursula\Desktop\Awakening 2 Moonfell.lnk [2011.03.20 15:57:56 | 000,001,321 | ---- | M] () -- C:\Users\Ursula\Desktop\MCF7Collectors - Verknüpfung.lnk [2011.02.24 09:49:48 | 000,001,986 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 9.lnk [2011.02.22 12:02:27 | 000,003,584 | ---- | M] () -- C:\Users\Ursula\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini ========== Files Created - No Company Name ========== [2011.03.22 11:10:02 | 000,742,874 | ---- | C] () -- C:\Users\Ursula\Desktop\Load.exe [2011.03.22 10:55:46 | 000,000,250 | ---- | C] () -- C:\Users\Ursula\Desktop\gmer.ini [2011.03.22 10:55:33 | 000,884,736 | ---- | C] () -- C:\Windows\gmer.dll [2011.03.22 10:55:33 | 000,000,080 | ---- | C] () -- C:\Windows\gmer_uninstall.cmd [2011.03.22 10:55:32 | 000,811,008 | ---- | C] () -- C:\Windows\gmer.exe [2011.03.22 10:55:32 | 000,300,544 | ---- | C] () -- C:\Users\Ursula\Desktop\Tralala.dll [2011.03.22 10:55:25 | 000,811,008 | ---- | C] () -- C:\Users\Ursula\Desktop\Tralala.exe [2011.03.21 13:19:10 | 000,000,967 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk [2011.03.21 12:51:21 | 000,002,398 | ---- | C] () -- C:\Users\Ursula\Desktop\Reincarnations 2.lnk [2011.03.21 12:50:09 | 000,002,121 | ---- | C] () -- C:\Users\Ursula\Desktop\Reincarnations - Awakening.lnk [2011.03.21 12:43:45 | 000,001,572 | ---- | C] () -- C:\Users\Ursula\Desktop\Haunted Legends - The Queen of Spades CE.lnk [2011.03.21 12:04:37 | 000,001,889 | ---- | C] () -- C:\Users\Ursula\Desktop\Awakening 2 Moonfell.lnk [2011.03.20 17:27:33 | 000,001,321 | ---- | C] () -- C:\Users\Ursula\Desktop\MCF7Collectors - Verknüpfung.lnk [2011.02.22 12:02:27 | 000,003,584 | ---- | C] () -- C:\Users\Ursula\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.11.15 19:16:23 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2009.11.15 18:21:37 | 000,650,054 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2009.11.15 18:21:37 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2009.11.15 18:21:37 | 000,129,608 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2009.11.15 18:21:37 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2009.11.15 18:05:07 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 05:33:53 | 000,342,120 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2009.07.14 03:05:48 | 000,614,236 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2009.07.14 03:05:48 | 000,106,356 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2009.07.14 01:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll [2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll [2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll [2005.05.06 19:06:00 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 76 bytes -> C:\Users\Ursula\Documents\Uni Arbeiten:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\Ursula\Documents\Downloads:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\Ursula\Documents\Donata SCHULE:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\Ursula\Documents\Digital Wave Player:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\Ursula\Documents\Digibib4:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Users\Ursula\Documents\DA:Roxio EMC Stream @Alternate Data Stream - 200 bytes -> C:\ProgramData\TEMP:8E5EA40F @Alternate Data Stream - 193 bytes -> C:\ProgramData\TEMP:C22674B6 @Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:2AE74FF9 < End of report > lg und Danke |
|
22.03.2011, 13:59
| #5 |
| | Firefox leitet um will "Update" herunterladen OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 22.03.2011 13:49:26 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\Ursula\Desktop
Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 60,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 77,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 99,18 Gb Total Space | 22,05 Gb Free Space | 22,24% Space Free | Partition Type: NTFS
Drive D: | 111,79 Gb Total Space | 100,70 Gb Free Space | 90,08% Space Free | Partition Type: NTFS
Drive E: | 10,00 Gb Total Space | 5,96 Gb Free Space | 59,58% Space Free | Partition Type: NTFS
Computer Name: URSULA-PC | User Name: Ursula | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "C:\Program Files\Microsoft Office 2007\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Program Files\Microsoft Office 2007\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1ED31028-6D65-4CFD-AD03-8E484A052FE7}" = aonUpdate
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{291A06BB-7145-443F-9257-8913A928BD40}" = Controller
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5BF5F9C5-E95B-4AFA-94BE-F2A9CA73B61D}" = Apple Mobile Device Support
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A212E6C2-20F7-4A8E-BD8E-DC3EE7483FA2}" = PRS-500 USB driver
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AAD47011-8518-4608-9656-951DA35B587B}" = iTunes
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.2 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{B70E5793-F912-4C62-AFE2-C4F0B078FD31}" = Reader Library by Sony
"{B83FC356-B7C0-441F-8A4D-D71E088E7974}" = NVIDIA PhysX
"{CF097717-F174-4144-954A-FBC4BF301031}" = Nero 7 Premium
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"3DataManager" = 3DataManager
"75070B1806113224B16C70296B90DD1AD8A53479" = Windows Driver Package - Sony Corporation (PRSUSB) USB (08/08/2006 1.0.03.08080)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"aonUpdate" = aonUpdate
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Awakening 2 Moonfell Wood 1.00" = Awakening 2 Moonfell Wood 1.00
"BFGC" = Big Fish Games Client
"BFG-Mystery Case Files - Rueckkehr nach Ravenhearst" = Mystery Case Files: Rückkehr nach Ravenhearst ™
"CCleaner" = CCleaner
"Controller" = Controller
"Creative OEM002" = Laptop Integrated Webcam Driver (1.04.01.1011)
"Digital Editions" = Adobe Digital Editions
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EPSON Scanner" = EPSON Scan
"EPSON Stylus SX200 Series" = EPSON Stylus SX200 Series Printer Uninstall
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mobile Partner" = Mobile Partner
"Mozilla Firefox (3.6.15)" = Mozilla Firefox (3.6.15)
"Mystery Case Files - Dire Grove Collector's Edition1.0" = Mystery Case Files - Dire Grove Collector's Edition
"NVIDIA Drivers" = NVIDIA Drivers
"OpenVPN" = OpenVPN 2.1_rc4
"Reincarnations - Awakening1.0" = Reincarnations - Awakening
"Reincarnations 2 Uncover the Past Collectors Edition 1.00" = Reincarnations 2 Uncover the Past Collectors Edition 1.00
"Spamihilator" = Spamihilator
"SystemRequirementsLab" = System Requirements Lab
"uTorrent" = µTorrent
"WinRAR archiver" = WinRAR
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 21.03.2011 08:40:26 | Computer Name = Ursula-PC | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
Error - 21.03.2011 08:40:32 | Computer Name = Ursula-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .
Error - 21.03.2011 08:40:32 | Computer Name = Ursula-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .
Error - 21.03.2011 09:01:58 | Computer Name = Ursula-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: A required certificate is not within its validity period when verifying
against the current system clock or the timestamp in the signed file. .
Error - 21.03.2011 09:09:44 | Computer Name = Ursula-PC | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
Error - 21.03.2011 11:34:19 | Computer Name = Ursula-PC | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
Error - 21.03.2011 11:51:01 | Computer Name = Ursula-PC | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
Error - 21.03.2011 11:54:18 | Computer Name = Ursula-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Users\Ursula\AppData\Local\Temp\RarSFX0\redist.dll".
Die
abhängige Assemblierung "Microsoft.VC90.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.30729.4148""
konnte nicht gefunden werden. Verwenden Sie für eine detaillierte Diagnose das Programm
"sxstrace.exe".
Error - 21.03.2011 12:00:37 | Computer Name = Ursula-PC | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
Error - 22.03.2011 08:47:02 | Computer Name = Ursula-PC | Source = Winlogon | ID = 4103
Description = Fehler bei der Windows-Lizenzaktivierung. Fehler 0x80070005.
[ System Events ]
Error - 21.03.2011 08:36:57 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "TCP/IP NetBIOS Helper" ist vom Dienst "Ancillary Function
Driver for Winsock" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%31
Error - 21.03.2011 08:36:57 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Network Store Interface Service" ist vom Dienst "NSI proxy
service driver." abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%31
Error - 21.03.2011 08:36:57 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Network Location Awareness" ist vom Dienst "Network Store
Interface Service" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error - 21.03.2011 08:36:57 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Workstation" ist vom Dienst "Network Store Interface Service"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 21.03.2011 08:36:57 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "IP Helper" ist vom Dienst "Network Store Interface Service"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 21.03.2011 08:36:57 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "SMB MiniRedirector Wrapper and Engine" ist vom Dienst
"Redirected Buffering Sub Sysytem" abhängig, der aufgrund folgenden Fehlers nicht
gestartet wurde: %%31
Error - 21.03.2011 08:36:57 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "SMB 1.x MiniRedirector" ist vom Dienst "SMB MiniRedirector
Wrapper and Engine" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error - 21.03.2011 08:36:57 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "SMB 2.0 MiniRedirector" ist vom Dienst "SMB MiniRedirector
Wrapper and Engine" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error - 21.03.2011 08:37:00 | Computer Name = Ursula-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFD avgio avipbb CSC DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr ssmdrv tdx Wanarpv6
WfpLwf
Error - 22.03.2011 03:40:28 | Computer Name = Ursula-PC | Source = DCOM | ID = 10001
Description =
< End of report >
|
|
22.03.2011, 15:51
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Firefox leitet um will "Update" herunterladen Downloade Dir bitte WVCheck von Artellos.com
__________________ --> Firefox leitet um will "Update" herunterladen |
|
| Themen zu Firefox leitet um will "Update" herunterladen |
| c:\windows\system32\rundll32.exe, code, crypt, datei, download, ergebnis, explorer.exe, firefox, free, google, hintergrund, leitet, links, locker, log, log file, mozilla, ntdll.dll, registry, rootkit, rundll, rundll32.exe, scan, secur, seite, system, system32, update |
Linear-Darstellung
