| |
| |||||||
Log-Analyse und Auswertung: Acer 5710 dauernd "keine Rückmeldung"Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
26.06.2011, 14:29
| #1 |
 |  Acer 5710 dauernd "keine Rückmeldung" Servesa! Der Lappi meiner Freundin hat das Problem, dass verschiedene Programme in ungleichen Abständen mit "keine Rückmeldung" hängenbleiben. Manchmal läuft er den ganzen Tag durch und manchmal passiert das alle 10min. Die Programme sind verschieden, Firefox, Adobe Reader....  Ein Log von Defogger habe ich hier leider nicht, weil das irgendwie den Dienst verweigerte. Es erstellt zwar ein Logfile, aber dort steht nicht viel drin und zum Neustart fordert es mich auch nicht auf. Hier mal die anderen zwei: Code:
ATTFilter GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-06-26 15:19:58
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-2 Hitachi_HTS541616J9SA00 rev.SB4OC70P
Running: we5mogu8.exe; Driver: C:\Users\XXXX\AppData\Local\Temp\pwtoypoc.sys
---- System - GMER 1.0.15 ----
SSDT 8D93881E ZwCreateSection
SSDT 8D938823 ZwSetContextThread
SSDT 8D9387BF ZwTerminateProcess
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!ZwSaveKey + 13C1 82A8B339 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82AC4D52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 82ACBEEC 4 Bytes [1E, 88, 93, 8D]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1597 82ACC28C 4 Bytes [23, 88, 93, 8D]
.text ntkrnlpa.exe!KeRemoveQueueEx + 166F 82ACC364 4 Bytes [BF, 87, 93, 8D]
---- User code sections - GMER 1.0.15 ----
.text C:\Program Files\Mozilla Firefox\firefox.exe[2680] ntdll.dll!LdrLoadDll 779022B8 5 Bytes JMP 00A11410 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[3748] USER32.dll!SetWindowLongA 75D88BA3 5 Bytes JMP 66B7EDA6 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[3748] USER32.dll!SetWindowLongW 75D94449 5 Bytes JMP 66B7ED38 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[3748] USER32.dll!GetWindowInfo 75D94B5E 5 Bytes JMP 66995451 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[3748] USER32.dll!TrackPopupMenu 75DA2228 5 Bytes JMP 66995A99 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
Device \Driver\ACPI_HAL \Device\0000004b halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
Code:
ATTFilter OTL logfile created on: 26.06.2011 13:21:06 - Run 2 OTL by OldTimer - Version 3.2.24.1 Folder = C:\Users\XXXX\Downloads Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,99 Gb Total Physical Memory | 1,02 Gb Available Physical Memory | 51,18% Memory free 3,98 Gb Paging File | 2,70 Gb Available in Paging File | 67,95% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 148,95 Gb Total Space | 100,79 Gb Free Space | 67,67% Space Free | Partition Type: NTFS Computer Name: XXXX-PC | User Name: XXXX | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.06.25 12:28:45 | 000,411,432 | ---- | M] (Valve Corporation) -- C:\Programme\Common Files\Steam\SteamService.exe PRC - [2011.06.24 16:27:06 | 001,242,448 | ---- | M] (Valve Corporation) -- C:\Programme\Steam\Steam.exe PRC - [2011.06.24 10:44:51 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2011.06.18 23:08:06 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\XXXX\Downloads\OTL.exe PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.05.29 09:11:28 | 000,366,640 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2011.04.27 22:32:55 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe PRC - [2011.03.19 02:10:03 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2011.01.12 15:32:06 | 000,866,576 | ---- | M] (Intel(R) Corporation) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe PRC - [2011.01.12 15:13:16 | 000,481,552 | ---- | M] (Intel(R) Corporation) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe PRC - [2011.01.10 15:22:55 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2010.11.20 14:17:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe PRC - [2010.11.20 14:17:00 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe PRC - [2010.09.21 14:03:14 | 001,710,464 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE PRC - [2010.09.21 14:03:14 | 000,193,408 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe PRC - [2009.01.26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe ========== Modules (SafeList) ========== MOD - [2011.06.18 23:08:06 | 000,579,072 | ---- | M] (OldTimer Tools) -- C:\Users\XXXX\Downloads\OTL.exe MOD - [2010.11.20 13:55:09 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll ========== Win32 Services (SafeList) ========== SRV - [2011.06.25 12:28:45 | 000,411,432 | ---- | M] (Valve Corporation) [On_Demand | Running] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2011.05.29 09:11:28 | 000,366,640 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2011.04.27 22:32:55 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.03.19 02:10:03 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.01.12 15:32:06 | 000,866,576 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) Intel(R) SRV - [2011.01.12 15:13:16 | 000,481,552 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) Intel(R) SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009.06.18 16:19:30 | 000,935,208 | ---- | M] (Nero AG) [Disabled | Stopped] -- C:\Programme\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2009.01.26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService) ========== Driver Services (SafeList) ========== DRV - [2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2011.03.19 02:10:04 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011.02.27 00:24:39 | 000,071,680 | ---- | M] (Notebook Hardware Control) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\nhcDriver.sys -- (nhcDriverDevice) DRV - [2011.01.19 18:47:12 | 000,022,504 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\cpuz135_x32.sys -- (cpuz135) DRV - [2011.01.10 15:23:15 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmbus.sys -- (vmbus) DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmstorfl.sys -- (storflt) DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\storvsc.sys -- (storvsc) DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.11.20 12:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\vms3cap.sys -- (s3cap) DRV - [2010.10.07 14:11:37 | 006,639,616 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETwLv32.sys -- (NETwLv32) Intel(R) DRV - [2010.06.17 15:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.07.14 00:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Intel(R) DRV - [2008.07.26 23:30:30 | 000,014,416 | ---- | M] (OpenLibSys.org) [Kernel | On_Demand | Stopped] -- C:\Users\XXXX\Downloads\RealTemp_360\WinRing0.sys -- (WinRing0_1_2_0) DRV - [2007.01.31 18:10:14 | 000,046,592 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ESD7SK.sys -- (ESDCR) DRV - [2007.01.31 18:10:10 | 000,061,952 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ESM7SK.sys -- (ESMCR) DRV - [2007.01.31 18:10:06 | 000,067,584 | ---- | M] (ENE Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\EMS7SK.sys -- (EMSCR) DRV - [2005.05.25 10:39:06 | 000,004,608 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\RMClock\RTCore32.sys -- (RTCore32) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-2242133231-2987702924-2661805437-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-2242133231-2987702924-2661805437-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKU\S-1-5-21-2242133231-2987702924-2661805437-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = EF 1F 88 3D A1 01 CC 01 [binary data] IE - HKU\S-1-5-21-2242133231-2987702924-2661805437-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.5 FF - prefs.js..extensions.enabledItems: {6614d11d-d21d-b211-ae23-815234e1ebb5}:1.0.23 FF - prefs.js..extensions.enabledItems: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3}:1.49 FF - prefs.js..extensions.enabledItems: {cf47767d-5f3a-4e32-9fce-5d79565c9702}:1.1.2 FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.8.6 FF - prefs.js..extensions.enabledItems: {9AA46F4F-4DC7-4c06-97AF-5035170634FE}:4.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..network.proxy.type: 0 FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.06.24 10:44:52 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.16 12:33:47 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.06.24 16:39:20 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2011.02.21 00:09:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXXX\AppData\Roaming\mozilla\Extensions [2011.02.21 00:09:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXXX\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2011.06.23 12:29:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXXX\AppData\Roaming\mozilla\Firefox\Profiles\sall1p73.default\extensions [2011.02.16 23:39:22 | 000,000,000 | ---D | M] (Dr.Web anti-virus link checker) -- C:\Users\XXXX\AppData\Roaming\mozilla\Firefox\Profiles\sall1p73.default\extensions\{6614d11d-d21d-b211-ae23-815234e1ebb5} [2011.06.23 12:29:30 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\XXXX\AppData\Roaming\mozilla\Firefox\Profiles\sall1p73.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2011.06.11 16:03:18 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2011.02.16 22:28:56 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.02.19 00:20:50 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011.06.11 16:03:18 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} File not found (No name found) -- [2011.02.16 22:28:56 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.02.19 00:20:50 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011.06.11 16:03:18 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} () (No name found) -- C:\USERS\XXXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SALL1P73.DEFAULT\EXTENSIONS\{9AA46F4F-4DC7-4C06-97AF-5035170634FE}.XPI () (No name found) -- C:\USERS\XXXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SALL1P73.DEFAULT\EXTENSIONS\{CF47767D-5F3A-4E32-9FCE-5D79565C9702}.XPI () (No name found) -- C:\USERS\XXXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SALL1P73.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI () (No name found) -- C:\USERS\XXXX\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\SALL1P73.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI [2011.06.24 10:44:51 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll [2011.05.04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2011.04.03 11:46:46 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2011.04.03 11:46:46 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml [2011.04.03 11:46:46 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2011.04.03 11:46:46 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2011.04.03 11:46:46 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2011.04.03 11:46:46 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.06.18 21:45:18 | 000,435,212 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 127.0.0.1 123fporn.info O1 - Hosts: 14976 more lines... O3 - HKU\S-1-5-21-2242133231-2987702924-2661805437-1000\..\Toolbar\ShellBrowser: (no name) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - No CLSID value found. O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\S-1-5-21-2242133231-2987702924-2661805437-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-2242133231-2987702924-2661805437-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKU\S-1-5-21-2242133231-2987702924-2661805437-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found MsConfig - State: "services" - 0 MsConfig - State: "startup" - 0 ========== Files/Folders - Created Within 30 Days ========== [2011.06.25 13:56:20 | 000,000,000 | ---D | C] -- C:\Users\XXXX\AppData\Roaming\Malwarebytes [2011.06.25 13:56:11 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2011.06.25 13:56:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.06.25 13:56:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.06.25 13:56:04 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.06.25 13:56:04 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2011.06.25 13:33:09 | 000,000,000 | ---D | C] -- C:\Users\XXXX\AppData\Local\Nero [2011.06.24 15:11:24 | 000,000,000 | ---D | C] -- C:\Users\XXXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam [2011.06.24 14:50:03 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Steam [2011.06.24 14:50:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam [2011.06.24 14:50:01 | 000,000,000 | ---D | C] -- C:\Programme\Steam [2011.06.19 14:50:39 | 000,000,000 | ---D | C] -- C:\Users\XXXX\AppData\Local\Diagnostics [2011.06.19 14:02:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner [2011.06.19 14:02:20 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner [2011.06.19 13:27:17 | 000,000,000 | ---D | C] -- C:\drivers [2011.06.18 21:18:27 | 000,000,000 | ---D | C] -- C:\Users\XXXX\AppData\Local\ElevatedDiagnostics [2011.06.16 12:33:36 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Adobe [2011.06.16 12:33:36 | 000,000,000 | ---D | C] -- C:\Programme\Adobe [2011.06.13 15:59:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN [2011.06.13 15:41:08 | 000,000,000 | ---D | C] -- C:\Users\XXXX\AppData\Roaming\vlc [2011.06.12 23:39:36 | 000,000,000 | ---D | C] -- C:\Users\XXXX\AppData\Roaming\OpenOffice.org [2011.06.12 23:38:53 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.3 [2011.06.12 23:37:36 | 000,000,000 | ---D | C] -- C:\Programme\OpenOffice.org 3 [2011.06.12 23:34:02 | 000,000,000 | ---D | C] -- C:\Users\XXXX\Roaming [2011.06.12 23:34:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Roaming [2011.06.12 23:32:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet Wireless [2011.06.12 23:32:53 | 000,000,000 | ---D | C] -- C:\Programme\Cisco [2011.06.12 23:32:49 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Intel [2011.06.12 23:32:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Intel [2011.06.11 16:03:33 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java [2011.06.11 14:22:47 | 000,000,000 | -HSD | C] -- C:\Windows\System32\%APPDATA% [2011.06.11 10:52:27 | 000,000,000 | ---D | C] -- C:\Users\XXXX\AppData\Local\{CC0E2A9C-C21E-476D-94CC-20E54AB33F37} [2011.06.10 19:45:40 | 000,000,000 | ---D | C] -- C:\Users\XXXX\AppData\Local\{F2D4AB9E-20DC-480B-9371-A8E6D7E5F060} [2011.06.10 19:45:26 | 000,000,000 | ---D | C] -- C:\Users\XXXX\Tracing [2011.06.10 19:36:41 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2011.06.10 19:34:47 | 000,000,000 | ---D | C] -- C:\Programme\Windows Live [2011.06.10 19:32:11 | 000,000,000 | ---D | C] -- C:\Users\XXXX\AppData\Local\Windows Live [2011.06.10 19:32:10 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Windows Live [2011.05.29 13:13:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype Extras [2011.05.29 13:10:12 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Skype [2011.05.29 13:10:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype ========== Files - Modified Within 30 Days ========== [2011.06.26 11:59:04 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.06.26 11:59:04 | 000,014,192 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.06.26 11:55:10 | 000,654,166 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.06.26 11:55:10 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.06.26 11:55:10 | 000,130,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.06.26 11:55:10 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.06.26 11:50:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.06.26 11:50:32 | 1602,838,528 | -HS- | M] () -- C:\hiberfil.sys [2011.06.25 13:56:11 | 000,001,077 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.06.25 12:25:00 | 000,007,628 | ---- | M] () -- C:\Users\XXXX\AppData\Local\Resmon.ResmonCfg [2011.06.24 13:31:38 | 000,047,262 | ---- | M] () -- C:\Users\XXXX\Documents\cc_20110624_133130.reg [2011.06.24 10:08:06 | 000,001,459 | ---- | M] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk [2011.06.19 14:51:40 | 000,001,029 | ---- | M] () -- C:\Users\Public\Desktop\ImgBurn.lnk [2011.06.19 13:47:24 | 000,000,680 | RHS- | M] () -- C:\Users\XXXX\ntuser.pol [2011.06.18 22:56:06 | 000,148,959 | ---- | M] () -- C:\Users\XXXX\Desktop\bfb.pdf [2011.06.18 21:45:18 | 000,435,212 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts [2011.06.15 15:46:36 | 000,087,406 | ---- | M] () -- C:\Users\XXXX\Desktop\Maja+Antonyhochzeit.jpg [2011.06.13 14:26:38 | 000,004,545 | ---- | M] () -- C:\WirelessDiagLog.csv [2011.06.13 13:56:03 | 000,434,874 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20110618-214518.backup [2011.06.13 13:23:20 | 000,292,696 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2011.06.04 14:14:30 | 000,434,874 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts.20110613-135603.backup [2011.05.29 13:10:12 | 000,002,503 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2011.05.29 09:11:30 | 000,039,984 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2011.05.29 09:11:20 | 000,022,712 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys ========== Files Created - No Company Name ========== [2011.06.25 13:56:11 | 000,001,077 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk [2011.06.24 23:50:31 | 000,007,628 | ---- | C] () -- C:\Users\XXXX\AppData\Local\Resmon.ResmonCfg [2011.06.24 13:31:35 | 000,047,262 | ---- | C] () -- C:\Users\XXXX\Documents\cc_20110624_133130.reg [2011.06.19 13:43:19 | 000,000,680 | RHS- | C] () -- C:\Users\XXXX\ntuser.pol [2011.06.18 22:56:02 | 000,148,959 | ---- | C] () -- C:\Users\XXXX\Desktop\bfb.pdf [2011.06.16 12:33:47 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk [2011.06.15 15:46:35 | 000,087,406 | ---- | C] () -- C:\Users\XXXX\Desktop\Maja+Antonyhochzeit.jpg [2011.06.12 23:38:53 | 000,001,459 | ---- | C] () -- C:\Users\Public\Desktop\OpenOffice.org 3.3.lnk [2011.06.10 19:39:58 | 000,002,438 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk [2011.05.29 13:10:12 | 000,002,503 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk [2011.03.12 23:11:08 | 000,004,767 | ---- | C] () -- C:\Windows\Irremote.ini [2011.03.12 22:37:52 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2011.03.08 11:56:57 | 000,356,352 | ---- | C] () -- C:\Windows\EMCRI.dll [2011.02.25 14:23:13 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe [2011.02.25 14:21:50 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2009.07.14 10:47:43 | 000,654,166 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2009.07.14 10:47:43 | 000,130,006 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 06:33:53 | 000,292,696 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2009.07.14 04:05:48 | 000,616,008 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2009.07.14 04:05:48 | 000,106,388 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat ========== LOP Check ========== [2011.03.10 21:34:12 | 000,000,000 | ---D | M] -- C:\Users\XXXX\AppData\Roaming\ImgBurn [2011.04.24 14:23:08 | 000,000,000 | ---D | M] -- C:\Users\XXXX\AppData\Roaming\LolClient [2011.02.27 00:24:35 | 000,000,000 | ---D | M] -- C:\Users\XXXX\AppData\Roaming\Notebook Hardware Control [2011.06.12 23:39:36 | 000,000,000 | ---D | M] -- C:\Users\XXXX\AppData\Roaming\OpenOffice.org [2011.02.21 00:09:17 | 000,000,000 | ---D | M] -- C:\Users\XXXX\AppData\Roaming\Thunderbird [2011.06.05 19:11:24 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.06.19 13:48:15 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2011.02.25 14:27:06 | 000,000,000 | ---D | M] -- C:\9f1ce71ed6c9a15bcaed4226574459ef [2011.02.10 14:03:39 | 000,000,000 | ---D | M] -- C:\Acer [2009.07.14 06:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2011.02.10 03:08:29 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2011.06.19 13:27:17 | 000,000,000 | ---D | M] -- C:\drivers [2011.02.16 22:37:37 | 000,000,000 | ---D | M] -- C:\Intel [2011.06.19 13:56:36 | 000,000,000 | ---D | M] -- C:\PerfLogs [2011.06.25 13:56:04 | 000,000,000 | R--D | M] -- C:\Programme [2011.06.25 13:56:08 | 000,000,000 | -H-D | M] -- C:\ProgramData [2011.02.10 03:08:29 | 000,000,000 | -HSD | M] -- C:\Programme [2011.02.10 03:08:30 | 000,000,000 | -HSD | M] -- C:\Recovery [2011.04.02 21:10:42 | 000,000,000 | ---D | M] -- C:\Riot Games [2011.02.27 00:20:33 | 000,000,000 | ---D | M] -- C:\swsetup [2011.06.26 11:50:41 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.06.19 13:55:20 | 000,000,000 | R--D | M] -- C:\Users [2011.06.24 13:24:22 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < MD5 for: EXPLORER.EXE > [2011.02.26 07:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe [2010.11.20 14:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe < MD5 for: REGEDIT.EXE > [2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe [2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_f4050b883d2c3c08\regedit.exe < MD5 for: USERINIT.EXE > [2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe [2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe [2010.11.20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-06-24 08:32:40 ========== Alternate Data Streams ========== @Alternate Data Stream - 106 bytes -> C:\ProgramData\TEMP:0E08FC17 < End of report > |
|
26.06.2011, 15:03
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Acer 5710 dauernd "keine Rückmeldung"Zitat:
__________________ |
|
26.06.2011, 16:59
| #3 |
| | Acer 5710 dauernd "keine Rückmeldung" Ausgeführt und nix gefunden...
__________________ |
|
27.06.2011, 09:32
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Acer 5710 dauernd "keine Rückmeldung" Ich möchte trotzdem die Logs dazu sehen
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
27.06.2011, 12:01
| #5 |
| | Acer 5710 dauernd "keine Rückmeldung" Die konnte ich gestern nicht finden. Wo werden die gespeichert. Muss die dann am Wochenende nachreichen. |
|
27.06.2011, 12:19
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Acer 5710 dauernd "keine Rückmeldung" Programm starten, Reiter Logdatein
__________________ --> Acer 5710 dauernd "keine Rückmeldung" |
|
02.07.2011, 18:03
| #7 | ||
| | Acer 5710 dauernd "keine Rückmeldung" Hier die Logs... Zitat:
Zitat:
|
|
03.07.2011, 13:25
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Acer 5710 dauernd "keine Rückmeldung" Sieht unauffällig aus. Ich würde erstmal versuchen rauszufinden, ob das nur unter Windows so ist, oder auch mit anderen Betriebssystemen. Lad dir mal sowas wie Knoppix oder Ubuntu herunter, brenn die iso Datei per Imagebrennfunktion auf eine CD und boote den Rechner davon. Teste dann mal ausgiebig das System unter Linux und berichte ob es dort normal läuft oder instabil ist.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
04.07.2011, 14:30
| #9 |
| | Acer 5710 dauernd "keine Rückmeldung" Ja so in die Richtung hatte ich auch schon gedacht. In der Ereignisanzeige stehen auch ein Haufen Controllerfehler drin, die sowas ja auch verursachen können. Allerdings steht da nie einer zu der Zeit drin wo das System hängenbleibt. |
|
04.07.2011, 14:32
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Acer 5710 dauernd "keine Rückmeldung" Controllerfehler? Hast du die extras.txt von OTL noch? Da ist ein Auszug aus der Ereignisanzeige.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
10.07.2011, 11:53
| #11 |
| | Acer 5710 dauernd "keine Rückmeldung" Ich habe hier keine Extras.txt...habe mir die Ereignisse aber nochmal angesehen. Habe jedes Mal wenn der PC hängenbleibt ein TIMEOUT drinstehen. Meistens bei svchost aber auch bei anderen Sachen. Geändert von DatHirschi (10.07.2011 um 12:27 Uhr) |
|
12.07.2011, 11:53
| #12 |
| | Acer 5710 dauernd "keine Rückmeldung" So, neue Erkenntnisse... Nach dem Beenden des SDDP-Dienstes (oder wie der heißt) und dem Ersetzen von AntiVir durch die Security Essentials läuft die Kiste vorerst problemlos. |
|
12.07.2011, 21:29
| #14 |
| | Acer 5710 dauernd "keine Rückmeldung" Ich werde das noch bis zum Wochenende beobachten und wenn nichts weiter passiert betrachte ich das hier als gelöst. |
|
| Themen zu Acer 5710 dauernd "keine Rückmeldung" |
| "keine rückmeldung", adobe, alternate, antivir, avira, c:\windows\system32\rundll32.exe, defender, desktop, dr.web, explorer, firefox, format, getwindowinfo, harddisk, keine rückmeldung, langs, locker, log, logfile, malwarebytes, mozilla, mozilla thunderbird, neustart, notebook, ntdll.dll, plug-in, problem, programme, registry, rundll, safer networking, scan, searchplugins, software, start menu, system, temp, webcheck, winlogon.exe |
Linear-Darstellung
