| |
| |||||||
Log-Analyse und Auswertung: Escan findet 252 Viren !Gen:Trojan.Heur.GM.104480A108 (DB) im C:\ProgramData\Avira\AntiVir Desktop\IWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
03.07.2011, 23:06
| #1 |
| |  Escan findet 252 Viren !Gen:Trojan.Heur.GM.104480A108 (DB) im C:\ProgramData\Avira\AntiVir Desktop\I Ich habe eine gesplittete Festplatte. So auf der einen (/c) hatte ich bis jetzt Windows und alles andere zusammen und auf der anderen nur die Backups. Jetzt ist in den letzten tagen aber mein Internet so langsam geworden das ich an verschiedenen Tag und Nachtzeiten speedtests gemacht habe. Ich habe Dsl 16.000 aber bei den Speed test kann immer Downloadgeschwindigkeit um die 1500-1800 raus. Das fand ich schon sehr komisch also hab ich antivir meinen Pc durchforsten lassen wobei es aber nichts gefunden hat. Also hatte ich mich entschieden Windows neu aufzuspielen, was ich heute auch gemacht habe. Jetzt habe ich Windows aber ausversehen auf (/D) installiert und habe somit Windows 2 mal drauf. Jetzt hab ich versucht das Windows auf der anderen Festplatte zu löschen aber es hat nicht funktioniert weil ich wohl die berechtigung von Trusted Installer brauche. Jetzt habe ich mir escan runtergeladen weil ich immer noch wissen wollte wieso mein internet so langsam ist. Und escan hat dann 504 kritische objekte gefunden die alle gleich hießen: Gen:Trojan.Heur.GM.104480A108 (DB). Alle in diesem Ordner C:\ProgramData\Avira\AntiVir Desktop\INFECTED\ .Jetz hab ich escan nochmal laufen lassen und säubern lassen aber da stand dann nur das diese umbenannt worden. Jetz nach dem Scan findet er nur noch 252 kritische objekte. Jetzt wusste ich nicht mehr was ich tun sollte. Also hier eure verlangten logs. Defogger_disable.log defogger_disable by jpshortstuff (23.02.10.1) Log created at 23:36 on 03/07/2011 (Dave) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- Und der von OTL OTL.txt OTL logfile created on: 03.07.2011 23:40:26 - Run 1 OTL by OldTimer - Version 3.2.25.0 Folder = D:\Users\Dave\Desktop 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 3,17 Gb Available Physical Memory | 79,19% Memory free 8,00 Gb Paging File | 7,00 Gb Available in Paging File | 87,57% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files (x86) Drive C: | 229,13 Gb Total Space | 204,12 Gb Free Space | 89,09% Space Free | Partition Type: NTFS Drive D: | 228,82 Gb Total Space | 162,19 Gb Free Space | 70,88% Space Free | Partition Type: NTFS Computer Name: BLACKKEKZ | User Name: Dave | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.07.03 23:28:39 | 000,580,096 | ---- | M] (OldTimer Tools) -- D:\Users\Dave\Desktop\OTL.exe ========== Modules (SafeList) ========== MOD - [2011.07.03 23:28:39 | 000,580,096 | ---- | M] (OldTimer Tools) -- D:\Users\Dave\Desktop\OTL.exe MOD - [2009.07.14 03:03:50 | 001,680,896 | ---- | M] (Microsoft Corporation) -- D:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll ========== Win32 Services (SafeList) ========== SRV:64bit: - [2010.07.07 03:50:54 | 000,203,264 | ---- | M] (AMD) [Auto | Running] -- D:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- D:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- D:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2010.07.07 04:30:08 | 007,195,648 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- D:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2010.07.07 03:15:42 | 000,265,728 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- D:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2010.05.06 11:21:46 | 000,125,456 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- D:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV:64bit: - [2009.11.04 20:54:48 | 000,359,552 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- D:\Windows\SysNative\drivers\vpcvmm.sys -- (vpcvmm) DRV:64bit: - [2009.11.04 20:54:47 | 000,187,904 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- D:\Windows\SysNative\drivers\vpchbus.sys -- (vpcbus) DRV:64bit: - [2009.11.04 20:54:47 | 000,095,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- D:\Windows\SysNative\drivers\vpcusb.sys -- (vpcusb) DRV:64bit: - [2009.11.04 20:54:47 | 000,066,304 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- D:\Windows\SysNative\drivers\vpcnfltr.sys -- (vpcnfltr) DRV:64bit: - [2009.07.14 03:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- D:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2009.07.14 03:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- D:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- D:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- D:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- D:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- D:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 22:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand | Running] -- D:\Windows\SysNative\wbem\ntfs.mof -- (Ntfs) DRV:64bit: - [2009.06.10 22:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- D:\Windows\SysNative\drivers\yk62x64.sys -- (yukonw7) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- D:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- D:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- D:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- D:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = D:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = ED 4E FB 60 91 39 CC 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - D:\Windows\SysNative\drivers\etc\hosts O4 - HKLM..\Run: [StartCCC] D:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 153 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 153 O13 - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - D:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - D:\Windows\system32\Rundll32.exe D:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - D:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "D:\Windows\System32\rundll32.exe" "D:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - D:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - D:\Windows\SysWOW64\Rundll32.exe D:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - D:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "D:\Windows\SysWOW64\rundll32.exe" "D:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs:64bit: AppMgmt - D:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.07.03 23:28:34 | 000,580,096 | ---- | C] (OldTimer Tools) -- D:\Users\Dave\Desktop\OTL.exe [2011.07.03 21:49:50 | 000,000,000 | ---D | C] -- D:\Users\Dave\AppData\Local\Microsoft Games [2011.07.03 20:42:26 | 000,000,000 | ---D | C] -- D:\Windows\rundll16.exe [2011.07.03 20:42:26 | 000,000,000 | ---D | C] -- D:\Windows\logo1_.exe [2011.07.03 18:49:00 | 000,000,000 | ---D | C] -- D:\Windows\VDLL.DLL [2011.07.03 18:49:00 | 000,000,000 | ---D | C] -- D:\Windows\SysWow64\runouce.exe [2011.07.03 18:49:00 | 000,000,000 | ---D | C] -- D:\Windows\RUNDL132.EXE [2011.07.03 18:49:00 | 000,000,000 | ---D | C] -- D:\Windows\logo_1.exe [2011.07.03 18:27:42 | 000,034,048 | ---- | C] (MicroWorld Technologies Inc.) -- D:\Windows\SysWow64\eEmpty.exe [2011.07.03 18:27:38 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\Common Files\MicroWorld [2011.07.03 18:27:36 | 000,000,000 | ---D | C] -- D:\ProgramData\MicroWorld [2011.07.03 18:21:44 | 000,000,000 | ---D | C] -- D:\Users\Dave\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker [2011.07.03 18:21:44 | 000,000,000 | ---D | C] -- D:\Program Files\Unlocker [2011.07.03 17:33:23 | 000,000,000 | ---D | C] -- D:\Windows\Panther [2011.07.03 16:55:57 | 000,000,000 | ---D | C] -- D:\Users\Dave\AppData\Roaming\ATI [2011.07.03 16:55:57 | 000,000,000 | ---D | C] -- D:\Users\Dave\AppData\Local\ATI [2011.07.03 16:55:57 | 000,000,000 | ---D | C] -- D:\ProgramData\ATI [2011.07.03 16:54:09 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\Common Files\ATI Technologies [2011.07.03 16:53:58 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Catalyst Control Center [2011.07.03 16:52:59 | 000,000,000 | ---D | C] -- D:\Program Files\Common Files\ATI Technologies [2011.07.03 16:52:39 | 000,055,296 | ---- | C] (AMD) -- D:\Windows\SysNative\coinst.dll [2011.07.03 16:52:15 | 000,000,000 | ---D | C] -- D:\Program Files (x86)\ATI Technologies [2011.07.03 16:51:51 | 000,000,000 | -HSD | C] -- D:\Windows\Installer [2011.07.03 16:51:10 | 000,000,000 | ---D | C] -- D:\Program Files\ATI Technologies [2011.07.03 16:51:08 | 000,000,000 | ---D | C] -- D:\Program Files\ATI [2011.07.03 16:46:20 | 000,000,000 | R--D | C] -- D:\Users\Dave\Virtual Machines [2011.07.03 16:46:20 | 000,000,000 | R--D | C] -- D:\Users\Dave\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2011.07.03 16:46:20 | 000,000,000 | R--D | C] -- D:\Users\Dave\Searches [2011.07.03 16:46:20 | 000,000,000 | R--D | C] -- D:\Users\Dave\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2011.07.03 16:46:11 | 000,000,000 | ---D | C] -- D:\Users\Dave\AppData\Roaming\Identities [2011.07.03 16:46:09 | 000,000,000 | R--D | C] -- D:\Users\Dave\Contacts [2011.07.03 16:46:06 | 000,000,000 | ---D | C] -- D:\Users\Dave\AppData\Local\VirtualStore [2011.07.03 16:45:58 | 000,000,000 | --SD | C] -- D:\Users\Dave\AppData\Roaming\Microsoft [2011.07.03 16:45:58 | 000,000,000 | R--D | C] -- D:\Users\Dave\Videos [2011.07.03 16:45:58 | 000,000,000 | R--D | C] -- D:\Users\Dave\Saved Games [2011.07.03 16:45:58 | 000,000,000 | R--D | C] -- D:\Users\Dave\Pictures [2011.07.03 16:45:58 | 000,000,000 | R--D | C] -- D:\Users\Dave\Music [2011.07.03 16:45:58 | 000,000,000 | R--D | C] -- D:\Users\Dave\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2011.07.03 16:45:58 | 000,000,000 | R--D | C] -- D:\Users\Dave\Links [2011.07.03 16:45:58 | 000,000,000 | R--D | C] -- D:\Users\Dave\Favorites [2011.07.03 16:45:58 | 000,000,000 | R--D | C] -- D:\Users\Dave\Downloads [2011.07.03 16:45:58 | 000,000,000 | R--D | C] -- D:\Users\Dave\Documents [2011.07.03 16:45:58 | 000,000,000 | R--D | C] -- D:\Users\Dave\Desktop [2011.07.03 16:45:58 | 000,000,000 | R--D | C] -- D:\Users\Dave\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2011.07.03 16:45:58 | 000,000,000 | -HSD | C] -- D:\Users\Dave\Vorlagen [2011.07.03 16:45:58 | 000,000,000 | -HSD | C] -- D:\Users\Dave\AppData\Local\Verlauf [2011.07.03 16:45:58 | 000,000,000 | -HSD | C] -- D:\Users\Dave\AppData\Local\Temporary Internet Files [2011.07.03 16:45:58 | 000,000,000 | -HSD | C] -- D:\Users\Dave\Startmenü [2011.07.03 16:45:58 | 000,000,000 | -HSD | C] -- D:\Users\Dave\SendTo [2011.07.03 16:45:58 | 000,000,000 | -HSD | C] -- D:\Users\Dave\Recent [2011.07.03 16:45:58 | 000,000,000 | -HSD | C] -- D:\Users\Dave\Netzwerkumgebung [2011.07.03 16:45:58 | 000,000,000 | -HSD | C] -- D:\Users\Dave\Lokale Einstellungen [2011.07.03 16:45:58 | 000,000,000 | -HSD | C] -- D:\Users\Dave\Documents\Eigene Videos [2011.07.03 16:45:58 | 000,000,000 | -HSD | C] -- D:\Users\Dave\Documents\Eigene Musik [2011.07.03 16:45:58 | 000,000,000 | -HSD | C] -- D:\Users\Dave\Eigene Dateien [2011.07.03 16:45:58 | 000,000,000 | -HSD | C] -- D:\Users\Dave\Documents\Eigene Bilder [2011.07.03 16:45:58 | 000,000,000 | -HSD | C] -- D:\Users\Dave\Druckumgebung [2011.07.03 16:45:58 | 000,000,000 | -HSD | C] -- D:\Users\Dave\Cookies [2011.07.03 16:45:58 | 000,000,000 | -HSD | C] -- D:\Users\Dave\AppData\Local\Anwendungsdaten [2011.07.03 16:45:58 | 000,000,000 | -HSD | C] -- D:\Users\Dave\Anwendungsdaten [2011.07.03 16:45:58 | 000,000,000 | -H-D | C] -- D:\Users\Dave\AppData [2011.07.03 16:45:58 | 000,000,000 | ---D | C] -- D:\Users\Dave\AppData\Local\Temp [2011.07.03 16:45:58 | 000,000,000 | ---D | C] -- D:\Users\Dave\AppData\Local\Microsoft [2011.07.03 16:45:58 | 000,000,000 | ---D | C] -- D:\Users\Dave\AppData\Roaming\Media Center Programs [2011.07.03 16:45:31 | 000,000,000 | -HSD | C] -- D:\ProgramData\Vorlagen [2011.07.03 16:45:31 | 000,000,000 | -HSD | C] -- D:\ProgramData\Startmenü [2011.07.03 16:45:31 | 000,000,000 | -HSD | C] -- D:\Recovery [2011.07.03 16:45:31 | 000,000,000 | -HSD | C] -- D:\Programme [2011.07.03 16:45:31 | 000,000,000 | -HSD | C] -- D:\Program Files\Gemeinsame Dateien [2011.07.03 16:45:31 | 000,000,000 | -HSD | C] -- D:\ProgramData\Favoriten [2011.07.03 16:45:31 | 000,000,000 | -HSD | C] -- D:\Users\Public\Documents\Eigene Videos [2011.07.03 16:45:31 | 000,000,000 | -HSD | C] -- D:\Users\Public\Documents\Eigene Musik [2011.07.03 16:45:31 | 000,000,000 | -HSD | C] -- D:\Users\Public\Documents\Eigene Bilder [2011.07.03 16:45:31 | 000,000,000 | -HSD | C] -- D:\Dokumente und Einstellungen [2011.07.03 16:45:31 | 000,000,000 | -HSD | C] -- D:\ProgramData\Dokumente [2011.07.03 16:45:31 | 000,000,000 | -HSD | C] -- D:\ProgramData\Anwendungsdaten [2011.07.03 16:37:38 | 000,000,000 | ---D | C] -- D:\Windows\SoftwareDistribution [2011.07.03 16:34:30 | 000,000,000 | ---D | C] -- D:\Windows\Prefetch ========== Files - Modified Within 30 Days ========== [2011.07.03 23:39:25 | 000,013,536 | -H-- | M] () -- D:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.07.03 23:39:25 | 000,013,536 | -H-- | M] () -- D:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.07.03 23:36:36 | 001,472,002 | ---- | M] () -- D:\Windows\SysNative\PerfStringBackup.INI [2011.07.03 23:36:36 | 000,645,502 | ---- | M] () -- D:\Windows\SysNative\perfh007.dat [2011.07.03 23:36:36 | 000,607,530 | ---- | M] () -- D:\Windows\SysNative\perfh009.dat [2011.07.03 23:36:36 | 000,126,822 | ---- | M] () -- D:\Windows\SysNative\perfc007.dat [2011.07.03 23:36:36 | 000,103,908 | ---- | M] () -- D:\Windows\SysNative\perfc009.dat [2011.07.03 23:32:11 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat [2011.07.03 23:31:58 | 3220,824,064 | -HS- | M] () -- D:\hiberfil.sys [2011.07.03 23:30:11 | 000,001,556 | ---- | M] () -- D:\Users\Dave\Documents\pinfect.zip [2011.07.03 23:28:39 | 000,580,096 | ---- | M] (OldTimer Tools) -- D:\Users\Dave\Desktop\OTL.exe [2011.07.03 23:28:30 | 000,050,477 | ---- | M] () -- D:\Users\Dave\Desktop\Defogger.exe [2011.07.03 20:41:31 | 000,000,055 | ---- | M] () -- D:\Windows\Lic.xxx [2011.07.03 18:49:05 | 000,001,022 | ---- | M] () -- D:\Users\Dave\Desktop\MWAVSCAN.lnk [2011.07.03 18:27:41 | 000,034,048 | ---- | M] (MicroWorld Technologies Inc.) -- D:\Windows\SysWow64\eEmpty.exe [2011.07.03 16:55:28 | 000,000,000 | ---- | M] () -- D:\Windows\ativpsrm.bin [2011.07.03 16:40:51 | 000,057,050 | ---- | M] () -- D:\Windows\SysWow64\license.rtf [2011.07.03 16:40:51 | 000,057,050 | ---- | M] () -- D:\Windows\SysNative\license.rtf [2011.07.03 16:37:01 | 000,000,000 | -H-- | M] () -- D:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2011.07.03 16:35:11 | 000,274,464 | ---- | M] () -- D:\Windows\SysNative\FNTCACHE.DAT ========== Files Created - No Company Name ========== [2011.07.03 23:28:27 | 000,050,477 | ---- | C] () -- D:\Users\Dave\Desktop\Defogger.exe [2011.07.03 19:10:35 | 000,001,556 | ---- | C] () -- D:\Users\Dave\Documents\pinfect.zip [2011.07.03 18:49:05 | 000,001,022 | ---- | C] () -- D:\Users\Dave\Desktop\MWAVSCAN.lnk [2011.07.03 18:27:57 | 000,000,055 | ---- | C] () -- D:\Windows\Lic.xxx [2011.07.03 16:55:28 | 000,000,000 | ---- | C] () -- D:\Windows\ativpsrm.bin [2011.07.03 16:52:39 | 000,063,416 | ---- | C] () -- D:\Windows\SysNative\atiapfxx.blb [2011.07.03 16:52:39 | 000,021,682 | ---- | C] () -- D:\Windows\atiogl.xml [2011.07.03 16:52:39 | 000,002,857 | ---- | C] () -- D:\Windows\SysWow64\atipblag.dat [2011.07.03 16:52:39 | 000,002,857 | ---- | C] () -- D:\Windows\SysNative\atipblag.dat [2011.07.03 16:46:25 | 000,001,409 | ---- | C] () -- D:\Users\Dave\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk [2011.07.03 16:46:21 | 000,001,443 | ---- | C] () -- D:\Users\Dave\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2011.07.03 16:40:36 | 000,001,345 | ---- | C] () -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk [2011.07.03 16:40:29 | 000,001,326 | ---- | C] () -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk [2011.07.03 16:37:01 | 000,000,000 | -H-- | C] () -- D:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2011.07.03 16:34:28 | 3220,824,064 | -HS- | C] () -- D:\hiberfil.sys [2009.07.14 07:38:36 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat [2009.07.14 04:35:51 | 000,000,741 | ---- | C] () -- D:\Windows\SysWow64\NOISE.DAT [2009.07.14 04:34:42 | 000,215,943 | ---- | C] () -- D:\Windows\SysWow64\dssec.dat [2009.07.14 02:10:29 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin [2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 23:03:59 | 000,364,544 | ---- | C] () -- D:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\SysWow64\mlang.dat ========== LOP Check ========== [2009.07.14 07:08:49 | 000,001,890 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2009.11.29 22:53:42 | 000,000,000 | -H-D | M] -- D:\$AVG8.VAULT$ [2011.07.03 16:46:08 | 000,000,000 | -HSD | M] -- D:\$Recycle.Bin [2010.10.19 20:07:24 | 000,000,000 | ---D | M] -- D:\cad5942b7c029cca35dd11 [2010.10.01 16:34:38 | 000,000,000 | ---D | M] -- D:\DAVES-PC [2009.07.14 07:08:56 | 000,000,000 | -HSD | M] -- D:\Documents and Settings [2011.07.03 16:45:31 | 000,000,000 | -HSD | M] -- D:\Dokumente und Einstellungen [2008.08.05 20:05:25 | 000,000,000 | -H-D | M] -- D:\erData [2009.07.14 05:20:08 | 000,000,000 | ---D | M] -- D:\PerfLogs [2011.07.03 18:21:44 | 000,000,000 | R--D | M] -- D:\Program Files [2011.07.03 16:52:15 | 000,000,000 | R--D | M] -- D:\Program Files (x86) [2011.07.03 18:27:36 | 000,000,000 | -H-D | M] -- D:\ProgramData [2011.07.03 16:45:31 | 000,000,000 | -HSD | M] -- D:\Programme [2011.07.03 16:45:31 | 000,000,000 | -HSD | M] -- D:\Recovery [2011.07.03 23:41:01 | 000,000,000 | -HSD | M] -- D:\System Volume Information [2011.07.03 16:45:55 | 000,000,000 | R--D | M] -- D:\Users [2011.07.03 20:42:26 | 000,000,000 | ---D | M] -- D:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < MD5 for: EXPLORER.EXE > [2009.07.14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- D:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2009.11.04 20:56:34 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- D:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2009.11.04 20:56:34 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- D:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2009.11.04 20:56:35 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- D:\Windows\SysWOW64\explorer.exe [2009.11.04 20:56:35 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- D:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009.07.14 03:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- D:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2009.11.04 20:56:35 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- D:\Windows\explorer.exe [2009.11.04 20:56:35 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- D:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe < MD5 for: REGEDIT.EXE > [2009.07.14 03:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- D:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe [2009.07.14 03:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- D:\Windows\regedit.exe [2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- D:\Windows\SysWOW64\regedit.exe [2009.07.14 03:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- D:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe < MD5 for: USERINIT.EXE > [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- D:\Windows\SysWOW64\userinit.exe [2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- D:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- D:\Windows\SysNative\userinit.exe [2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- D:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- D:\Windows\SysNative\wininit.exe [2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- D:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- D:\Windows\SysWOW64\wininit.exe [2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- D:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- D:\Windows\SysNative\winlogon.exe [2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- D:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > < End of report > Und der letzte! Extras.txt OTL Extras logfile created on: 03.07.2011 23:40:26 - Run 1 OTL by OldTimer - Version 3.2.25.0 Folder = D:\Users\Dave\Desktop 64bit- Ultimate Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 3,17 Gb Available Physical Memory | 79,19% Memory free 8,00 Gb Paging File | 7,00 Gb Available in Paging File | 87,57% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files (x86) Drive C: | 229,13 Gb Total Space | 204,12 Gb Free Space | 89,09% Space Free | Partition Type: NTFS Drive D: | 228,82 Gb Total Space | 162,19 Gb Free Space | 70,88% Space Free | Partition Type: NTFS Computer Name: BLACKKEKZ | User Name: Dave | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .url[@ = InternetShortcut] -- D:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- D:\Windows\SysWow64\control.exe (Microsoft Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* File not found cmdfile [open] -- "%1" %* File not found comfile [open] -- "%1" %* File not found exefile [open] -- "%1" %* File not found helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" File not found inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "D:\Windows\System32\rundll32.exe" "D:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "D:\Windows\System32\rundll32.exe" "D:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* File not found regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" File not found scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l File not found scrfile [open] -- "%1" /S File not found txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 ========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{203DE003-C392-FF19-BCA2-3F775477BC94}" = AMD Drag and Drop Transcoding "{33A49BF2-CB4F-5E54-D7F5-25502CAB6B70}" = ATI AVIVO64 Codecs "{397878FC-1B1B-EED7-04A8-3184CE494A3B}" = ATI Catalyst Install Manager "{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 "{752CCAEE-8E33-DE50-9454-B377A2205193}" = ccc-utility64 "Unlocker" = Unlocker 1.9.1-x64 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{00FE2654-4377-8F53-55F4-83B70EE44C73}" = CCC Help Dutch "{01DD9D3D-FA8A-E148-008D-5CDF1BE8911F}" = CCC Help Korean "{02F5BD83-B529-37E3-B5DF-32ABC7EC63C4}" = ccc-core-static "{072224C5-0C98-0902-9A71-89D4A8F3E810}" = CCC Help Thai "{1229D58B-9185-4F85-71B2-4B34EBF8AD17}" = CCC Help Italian "{27C6CB2E-415B-6020-91FC-BA5CE3B912AC}" = CCC Help Russian "{29656550-8463-258C-55BA-5C4F7950DBDE}" = CCC Help Portuguese "{41B21B1F-950E-13FC-57C7-2AC44B196223}" = Catalyst Control Center Graphics Previews Vista "{48D5DBBA-7B60-B832-59DB-BE252C2E5A23}" = CCC Help Finnish "{490F45FA-738D-5D4A-6B9D-DC1373ACF794}" = CCC Help Polish "{53AFCE35-1653-91F4-8991-900731F32111}" = CCC Help Norwegian "{568EF3B9-C672-E82A-BCD4-A88072578521}" = CCC Help Swedish "{654733F2-22EC-776F-9C2D-CF3C4F578768}" = CCC Help Danish "{67ABC7E8-A241-F90D-0B04-5BB03428AF96}" = CCC Help Greek "{6AA30800-F713-BB43-EDA2-1C380FE7FD63}" = Catalyst Control Center Localization All "{6F235FE4-8EC6-3FAB-1739-A434BFE76E27}" = CCC Help Chinese Standard "{85090727-99E2-F1DC-1589-83D5AC986F3E}" = CCC Help Spanish "{87323561-58BA-4D5B-BADA-A791B69D1705}" = Catalyst Control Center - Branding "{9EEA437C-F436-755C-6B39-1840A33F45CF}" = Catalyst Control Center InstallProxy "{A05EF3DC-AAFA-6903-433D-0F383F5F4EC3}" = CCC Help German "{A317EF8E-66FB-94B6-C4FA-96A0AED1AB2F}" = CCC Help Chinese Traditional "{B2AF5585-FACF-7760-5C68-F2DC6BBACE47}" = CCC Help Czech "{BCA434F2-A541-F63E-890C-F5D14E5B33D0}" = CCC Help English "{C4406DB6-A28D-8047-7704-94A8DE7F6A68}" = CCC Help Hungarian "{D5134D14-A38D-A217-4310-5C8B6DFA08D0}" = HydraVision "{D79E2563-3FDD-0A62-187A-5BE5F920F317}" = CCC Help Turkish "{F538505D-D29C-6259-682C-E607D659B4B4}" = Catalyst Control Center Graphics Previews Common "{F820F894-EC5F-D52A-F862-5B472EAFE69A}" = CCC Help French "{FFB4E67D-DEF9-30BC-39F6-E9C1B05539F9}" = CCC Help Japanese ========== Last 10 Event Log Errors ========== [ Application Events ] Error - 03.07.2011 13:10:05 | Computer Name = BlackKekz | Source = Application Hang | ID = 1002 Description = Programm Unlocker.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: fe0 Startzeit: 01cc399d9c3af8e3 Endzeit: 16 Anwendungspfad: D:\Program Files\Unlocker\Unlocker.exe Berichts-ID: [ System Events ] Error - 03.07.2011 10:40:29 | Computer Name = 37L4247E29-32 | Source = DCOM | ID = 10010 Description = < End of report > Vielen Dank schonmal im vorraus! Viele grüße BlackKekz (: |
|
04.07.2011, 10:24
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Escan findet 252 Viren !Gen:Trojan.Heur.GM.104480A108 (DB) im C:\ProgramData\Avira\AntiVir Desktop\IZitat:
__________________ |
|
04.07.2011, 10:30
| #3 |
| | Escan findet 252 Viren !Gen:Trojan.Heur.GM.104480A108 (DB) im C:\ProgramData\Avira\AntiVir Desktop\I Und wie mache ich das am besten ?
__________________Bin nicht so erfahren mit sowas  |
|
04.07.2011, 10:49
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Escan findet 252 Viren !Gen:Trojan.Heur.GM.104480A108 (DB) im C:\ProgramData\Avira\AntiVir Desktop\I Folge dem Artikel zur Neuinstallation von Windows, nachdem du alle daten extern gesichert hast. Im Setup von Windows alle Partitionen auf der internen Platte auflösen, nach deinem Geschmack nur eine einrichten oder eine etwas kleinere für Windows und eine separate für Daten. Mal so als Hinweis, im Win7-Setup wird immer eine weitere kleine 100MB-Partition für das System erstellt, das kannst du nicht verhindern.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
04.07.2011, 11:06
| #5 |
| | Escan findet 252 Viren !Gen:Trojan.Heur.GM.104480A108 (DB) im C:\ProgramData\Avira\AntiVir Desktop\I Gibt es irgendwelche daten die ich extern sichern muss ? Sowas wie die ganzen dateien von Acer? ( Hab einen Acer ) |
|
04.07.2011, 11:15
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Escan findet 252 Viren !Gen:Trojan.Heur.GM.104480A108 (DB) im C:\ProgramData\Avira\AntiVir Desktop\I Was für Programme von Acer? Und was für ein Installationsmedium hast du? Normale Windows-DVD oder per Recovery-Disk bzw. Recovery-Partition? Eigentlich müsstest du wissen, welche Daten für dich wichtig sind.
__________________ --> Escan findet 252 Viren !Gen:Trojan.Heur.GM.104480A108 (DB) im C:\ProgramData\Avira\AntiVir Desktop\I |
|
04.07.2011, 11:24
| #7 |
| | Escan findet 252 Viren !Gen:Trojan.Heur.GM.104480A108 (DB) im C:\ProgramData\Avira\AntiVir Desktop\I Hab ne Windows CD! Eigentlich brauche ich nüchts mehr von meinem Pc.Ich will nur virenfrei sein! Ich habe so einen Bericht gelesen. Löschen aber sicher ! Da stand ich soll auf der Festplatte so Programme laufen lassen die irgenwelche methoden verwenden um die Festplatte ganz zu leeren. Ich glaube eine davon hieß die Gutmannsche? Soll ich einfach diesen Artikel den du mir geschickt hast befolgen und ist dann alles weg ? ( Also ich will ja das alles weg ist. ) |
|
04.07.2011, 12:32
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Escan findet 252 Viren !Gen:Trojan.Heur.GM.104480A108 (DB) im C:\ProgramData\Avira\AntiVir Desktop\I Daten shreddern ist unsinnig wenn man nur die Viren weg haben will. Lös einfach alle Partitionen auf, mach ein neues Partitionsschema und installier neu. Datenträger sicher löschen sollte man in Fällen, wenn man zB eine Fesplatte verkaufen und verhindern will, dass der neue Besitzer vermeintlich gelöschte Daten mit speziellen Tools wiederherstellen kann.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Escan findet 252 Viren !Gen:Trojan.Heur.GM.104480A108 (DB) im C:\ProgramData\Avira\AntiVir Desktop\I |
| .vault, 64-bit, antivir, avg, avira, desktop, downloadgeschwindigkeit, dsl, dslspeed, error, escan, explorer, format, infected, install.exe, internet, langsam, logfile, löschen, microsoft, neu, ordner, registry, rundll, security, shortcut, software, start menu, suche, syswow64, trojangeneric, viren, virus, webcheck, windows, windows 7, winlogon.exe |
Linear-Darstellung
