| |
| |||||||
Log-Analyse und Auswertung: Nach Malwarebytes-Suche fährt Windows nicht mehr hochWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
19.03.2013, 20:40
| #16 |
 |  Nach Malwarebytes-Suche fährt Windows nicht mehr hoch Jo, sorry: Code:
ATTFilter aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-03-19 19:41:49
-----------------------------
19:41:49.111 OS Version: Windows x64 6.1.7601 Service Pack 1
19:41:49.111 Number of processors: 4 586 0x2505
19:41:49.111 ComputerName: ALEX-PC UserName: Uli
19:41:50.031 Initialize success
19:41:57.972 AVAST engine defs: 13031900
19:42:47.704 The log file has been saved successfully to "C:\Users\Uli\Desktop\aswMBR.txt"
|
|
19.03.2013, 20:50
| #17 |
| /// TB-Ausbilder  | Nach Malwarebytes-Suche fährt Windows nicht mehr hoch Es sieht eigentlich alles normal aus. Mach mir mal bitte ein frisches OTL Log.
__________________Kontrollscan mit OTL
__________________ |
|
19.03.2013, 21:22
| #18 |
| | Nach Malwarebytes-Suche fährt Windows nicht mehr hoch Hier der OTL-Scan:
__________________Code:
ATTFilter aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-03-19 19:41:49
-----------------------------
19:41:49.111 OS Version: Windows x64 6.1.7601 Service Pack 1
19:41:49.111 Number of processors: 4 586 0x2505
19:41:49.111 ComputerName: ALEX-PC UserName: Uli
19:41:50.031 Initialize success
19:41:57.972 AVAST engine defs: 13031900
19:42:47.704 The log file has been saved successfully to "C:\Users\Uli\Desktop\aswMBR.txt"
sgeuli |
|
19.03.2013, 21:26
| #19 |
| /// TB-Ausbilder | Nach Malwarebytes-Suche fährt Windows nicht mehr hoch Das ist er nicht 
__________________  Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
19.03.2013, 21:45
| #20 |
| | Nach Malwarebytes-Suche fährt Windows nicht mehr hoch SORRY. Hier wirklich logfile von OTL: Code:
ATTFilter OTL logfile created on: 19.03.2013 21:11:41 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Uli\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,74 Gb Total Physical Memory | 2,95 Gb Available Physical Memory | 78,78% Memory free 7,48 Gb Paging File | 6,74 Gb Available in Paging File | 90,18% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 421,81 Gb Total Space | 218,12 Gb Free Space | 51,71% Space Free | Partition Type: NTFS Drive D: | 29,00 Gb Total Space | 19,01 Gb Free Space | 65,57% Space Free | Partition Type: NTFS Drive G: | 37,24 Gb Total Space | 12,69 Gb Free Space | 34,08% Space Free | Partition Type: FAT32 Drive H: | 959,28 Mb Total Space | 231,39 Mb Free Space | 24,12% Space Free | Partition Type: FAT Computer Name: ALEX-PC | User Name: Uli | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: All users | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.03.15 18:39:48 | 000,917,400 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2013.03.11 15:43:20 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Uli\Desktop\OTL.exe ========== Modules (No Company Name) ========== MOD - [2013.03.15 18:39:48 | 003,069,848 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ========== Services (SafeList) ========== SRV - [2013.03.15 18:39:48 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.03.15 14:01:38 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2012.12.14 16:49:28 | 000,682,344 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.12.14 16:49:28 | 000,398,184 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.07.13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012.05.08 12:49:53 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.05.08 12:49:53 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2010.07.11 19:09:20 | 001,620,584 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService) SRV - [2010.05.28 04:14:02 | 000,709,488 | ---- | M] (Egis Technology Inc. ) [Auto | Stopped] -- C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe -- (EgisTec Service) SRV - [2010.05.28 04:13:38 | 000,314,736 | ---- | M] (Egis Technology Inc. ) [Auto | Stopped] -- C:\Program Files (x86)\EgisTec BioExcess\EgisDSService.exe -- (EgisTec Data Security Service) SRV - [2010.05.19 18:21:26 | 000,322,416 | ---- | M] (Egis Technology Inc. ) [Auto | Stopped] -- C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe -- (EgisTec Service Help) SRV - [2010.04.20 14:29:08 | 000,903,456 | ---- | M] (Broadcom Corporation.) [Disabled | Stopped] -- C:\Programme\Lenovo\Bluetooth Software\btwdins.exe -- (btwdins) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.03.03 21:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) SRV - [2010.02.05 15:43:20 | 000,311,296 | ---- | M] (Realtek Semiconductor Corp.) [Auto | Stopped] -- C:\Programme\Realtek\RtLED\RtLEDService.exe -- (RtLedService) SRV - [2010.01.09 20:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.09.30 13:02:38 | 002,320,920 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2009.09.30 13:02:36 | 000,268,824 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2009.09.22 19:16:32 | 000,579,400 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Programme\Lenovo\ReadyComm\ConnSvc.exe -- (Lenovo ReadyComm ConnSvc) SRV - [2009.08.14 15:22:48 | 000,509,192 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Programme\Lenovo\ReadyComm\AppSvc.exe -- (Lenovo ReadyComm AppSvc) SRV - [2009.07.16 04:12:42 | 000,276,296 | ---- | M] (Lenovo Group Limited) [On_Demand | Stopped] -- C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll -- (PS_MDP) SRV - [2009.07.14 15:27:26 | 000,038,152 | ---- | M] (Lenovo Group Limited) [Auto | Stopped] -- C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe -- (IGRS) SRV - [2009.07.14 15:27:20 | 000,103,688 | ---- | M] (Lenovo Group Limited) [Auto | Stopped] -- C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll -- (ReadyComm.DirectRouter) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2009.05.01 16:57:50 | 000,077,032 | ---- | M] (Entriq, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\maxdome\DCBin\DCService.exe -- (Prosieben) SRV - [2007.05.31 09:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm) SRV - [2007.05.31 09:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr) ========== Driver Services (SafeList) ========== DRV:64bit: - [2012.12.14 16:49:28 | 000,024,176 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector) DRV:64bit: - [2012.05.08 12:49:53 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012.05.08 12:49:53 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.10.11 14:00:01 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2011.10.01 08:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftvollh.sys -- (Sftvol) DRV:64bit: - [2011.10.01 08:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftplaylh.sys -- (Sftplay) DRV:64bit: - [2011.10.01 08:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftredirlh.sys -- (Sftredir) DRV:64bit: - [2011.10.01 08:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Sftfslh.sys -- (Sftfs) DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 05:33:36 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 03:07:06 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.09.10 19:05:01 | 000,055,880 | ---- | M] (Egis Technology Inc.) [File_System | System | Stopped] -- C:\Windows\SysNative\drivers\EgisTecFF.sys -- (EgisTecFF) DRV:64bit: - [2010.09.10 18:47:40 | 000,035,888 | ---- | M] (EgisTec) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\FPSensor.sys -- (FPSensor) DRV:64bit: - [2010.09.10 18:47:38 | 000,060,464 | ---- | M] (Egis Technology Inc.) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk) DRV:64bit: - [2010.09.10 18:47:38 | 000,022,576 | ---- | M] (Egis Technology Inc.) [File_System | System | Stopped] -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys -- (mwlPSDFilter) DRV:64bit: - [2010.09.10 18:47:38 | 000,020,016 | ---- | M] (Egis Technology Inc.) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys -- (mwlPSDNServ) DRV:64bit: - [2010.08.25 19:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2010.07.11 22:40:00 | 000,024,680 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt) DRV:64bit: - [2010.05.10 11:17:50 | 000,229,488 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vm332avs.sys -- (vm332avs) DRV:64bit: - [2010.04.08 17:11:12 | 000,054,824 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btusbflt.sys -- (btusbflt) DRV:64bit: - [2010.03.26 10:14:50 | 000,162,304 | ---- | M] (ELAN Microelectronics Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ETD.sys -- (ETD) DRV:64bit: - [2010.03.24 10:57:20 | 000,243,744 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR) DRV:64bit: - [2010.03.03 20:51:40 | 000,540,696 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor) DRV:64bit: - [2010.02.25 18:32:12 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Impcd.sys -- (Impcd) DRV:64bit: - [2010.02.02 16:52:02 | 003,058,168 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX) DRV:64bit: - [2010.02.02 08:38:30 | 000,271,872 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) DRV:64bit: - [2010.01.15 19:08:34 | 000,039,008 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LhdX64.sys -- (LHDmgr) DRV:64bit: - [2010.01.15 07:23:20 | 000,098,344 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwaudio.sys -- (btwaudio) DRV:64bit: - [2010.01.15 07:23:14 | 000,132,648 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwavdt.sys -- (btwavdt) DRV:64bit: - [2010.01.15 07:23:10 | 000,021,288 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwrchid.sys -- (btwrchid) DRV:64bit: - [2009.11.17 08:16:44 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\SSPORT.sys -- (SSPORT) DRV:64bit: - [2009.10.19 01:40:50 | 000,028,176 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AcpiVpc.sys -- (ACPIVPC) DRV:64bit: - [2009.09.17 05:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (HECIx64) DRV:64bit: - [2009.07.21 15:20:06 | 000,121,840 | ---- | M] (CyberLink) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wsvd.sys -- (wsvd) DRV:64bit: - [2009.07.16 12:55:34 | 000,011,280 | ---- | M] (Lenovo) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WDMirror.sys -- (wdmirror) DRV:64bit: - [2009.07.16 04:38:20 | 000,079,376 | ---- | M] (Lenovo) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WDBridge.sys -- (Bridge0) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 21:35:28 | 005,434,368 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netw5v64.sys -- (netw5v64) DRV:64bit: - [2009.06.10 21:34:36 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\k57nd60a.sys -- (k57nd60a) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:34:18 | 000,057,344 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.04.07 08:33:08 | 000,035,104 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btwl2cap.sys -- (btwl2cap) DRV:64bit: - [2009.02.17 18:11:25 | 000,031,400 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO) DRV:64bit: - [2007.02.16 01:57:06 | 000,040,648 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ElbyCDFL.sys -- (ElbyCDFL) DRV - [2009.10.28 06:09:33 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Stopped] -- C:\Windows\SysWOW64\drivers\SSPORT.SYS -- (SSPORT) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2007.02.16 01:57:06 | 000,040,648 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysWOW64\drivers\ElbyCDFL.sys -- (ElbyCDFL) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-3405125656-1827659332-2632872805-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKU\S-1-5-21-3405125656-1827659332-2632872805-1004\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-3405125656-1827659332-2632872805-1004\..\SearchScopes\{061210E1-63AA-4505-8395-D36DF4FC773D}: "URL" = hxxp://de.wikipedia.org.anonymize-me.de/?to=64652E77696B6970656469612E6F7267&st={searchTerms}&clid=0a859d5b-f7ce-4a15-8671-870b7a66a78b&pid=sopcastde&mode=bounce&k=0 IE - HKU\S-1-5-21-3405125656-1827659332-2632872805-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com.anonymize-me.de/?anonymto=687474703A2F2F7777772E62696E672E636F6D2F7365617263683F713D7B7365617263685465726D737D26666F726D3D4C454E4446382670633D4D414C4E267372633D49452D536561726368426F78&st={searchTerms}&clid=0a859d5b-f7ce-4a15-8671-870b7a66a78b&pid=sopcastde&k=0 IE - HKU\S-1-5-21-3405125656-1827659332-2632872805-1004\..\SearchScopes\{184FB62D-CCD0-49F3-868C-578D296E75A2}: "URL" = hxxp://www.otto.de.anonymize-me.de/?to=6F74746F2E6465&st={searchTerms}&clid=0a859d5b-f7ce-4a15-8671-870b7a66a78b&pid=sopcastde&mode=bounce&k=0 IE - HKU\S-1-5-21-3405125656-1827659332-2632872805-1004\..\SearchScopes\{6A67688B-74F1-432B-B6E6-47A9EA18561E}: "URL" = hxxp://search.ebay.de.anonymize-me.de/?to=656261792E6465&st={searchTerms}&clid=0a859d5b-f7ce-4a15-8671-870b7a66a78b&pid=sopcastde&mode=bounce&k=0 IE - HKU\S-1-5-21-3405125656-1827659332-2632872805-1004\..\SearchScopes\{B07276D0-A4D5-48B8-B5E1-8DDA32B13FB1}: "URL" = hxxp://www.myvideo.de.anonymize-me.de/?to=6D79766964656F2E6465&st={searchTerms}&clid=0a859d5b-f7ce-4a15-8671-870b7a66a78b&pid=sopcastde&mode=bounce&k=0 IE - HKU\S-1-5-21-3405125656-1827659332-2632872805-1004\..\SearchScopes\{C68B6812-D596-4735-B8EC-82B608A68634}: "URL" = hxxp://www.amazon.de.anonymize-me.de/?to=616D617A6F6E2E6465&st={searchTerms}&clid=0a859d5b-f7ce-4a15-8671-870b7a66a78b&pid=sopcastde&mode=bounce&k=0 IE - HKU\S-1-5-21-3405125656-1827659332-2632872805-1004\..\SearchScopes\{D4F24595-E169-44D6-8064-44511CE92CAD}: "URL" = hxxp://www.pricerunner.de.anonymize-me.de/?to=707269636572756E6E65722E6465&st={searchTerms}&clid=0a859d5b-f7ce-4a15-8671-870b7a66a78b&pid=sopcastde&mode=bounce&k=0 IE - HKU\S-1-5-21-3405125656-1827659332-2632872805-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "www.google.de" FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10 FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.5.0.7896 FF - prefs.js..extensions.enabledItems: {E9FB7F44-E9EF-4050-B0A6-8CD9742BE715}:1.9.1 FF - prefs.js..extensions.enabledItems: plugin@loadtubes.com:1.03 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF64_11_6_602_180.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.) FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.03.15 18:39:48 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.03.13 18:51:54 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2011.06.05 20:43:20 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins [2013.01.17 16:20:51 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{E9FB7F44-E9EF-4050-B0A6-8CD9742BE715}: C:\Users\Uli\AppData\Local\{E9FB7F44-E9EF-4050-B0A6-8CD9742BE715} [2011.02.13 11:04:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Uli\AppData\Roaming\mozilla\Extensions [2013.02.23 00:27:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Uli\AppData\Roaming\mozilla\Firefox\Profiles\idsfssuc.default\extensions [2011.10.02 20:51:50 | 000,000,000 | ---D | M] (x-plugin-0) -- C:\Users\Uli\AppData\Roaming\mozilla\Firefox\Profiles\idsfssuc.default\extensions\plugin@loadtubes.com [2013.02.15 21:20:02 | 000,817,280 | ---- | M] () (No name found) -- C:\Users\Uli\AppData\Roaming\mozilla\firefox\profiles\idsfssuc.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011.12.02 21:02:10 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2011.07.04 12:07:21 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013.03.15 18:39:48 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2011.12.14 10:45:24 | 000,170,080 | ---- | M] (Tracker Software Products Ltd.) -- C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll [2013.03.15 18:39:46 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2013.03.15 18:39:46 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2013.03.15 18:39:46 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2013.03.15 18:39:46 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2011.10.02 20:51:50 | 000,000,139 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\Suche.src [2013.03.15 18:39:46 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2013.03.15 18:39:46 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2013.03.13 19:37:47 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (IEPwdBankBHO Class) - {56CBB761-DA41-4E31-B270-B13B4B0A61D0} - C:\Program Files (x86)\EgisTec BioExcess\EgisIEPwdBank.dll (Egis Technology Inc. ) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O3 - HKLM\..\Toolbar: (xplugin) - {DFEFCDEE-CF1A-4FC8-88AD-18272BE37E29} - C:\Users\Uli\AppData\Roaming\xplugin\toolbar.dll File not found O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-3405125656-1827659332-2632872805-1004\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O4:64bit: - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited) O4:64bit: - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited) O4:64bit: - HKLM..\Run: [ETDWare] C:\Programme\Elantech\ETDCtrl.exe (ELAN Microelectronics Corp.) O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [Ocs_SM] C:\Users\Uli\AppData\Roaming\OCS\SM\SearchAnonymizer.exe File not found O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [332BigDog] C:\Program Files (x86)\USB Camera2\VM332_STI.EXE (Vimicro) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [EgisUpdate] C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.) O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) O4 - HKLM..\Run: [IMSS] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe () O4 - HKLM..\Run: [PLTSR] C:\Program Files (x86)\EgisTec Port Locker\EgisPLTSR.exe (Egis Technology Inc. ) O4 - HKLM..\Run: [Samsung PanelMgr] C:\windows\Samsung\PanelMgr\ssmmgr.exe () O4 - HKLM..\Run: [UCam_Menu] C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [VitaKeyTSR] C:\Program Files (x86)\EgisTec BioExcess\EgisTSR.exe (Egis Technology Inc. ) O4 - HKU\S-1-5-21-3405125656-1827659332-2632872805-1004..\RunOnce: [SPReview] "C:\windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-3405125656-1827659332-2632872805-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-3405125656-1827659332-2632872805-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8:64bit: - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm () O8:64bit: - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\Lenovo\Bluetooth Software\btsendto_ie.htm () O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\Lenovo\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9:64bit: - Extra Button: @C:\Program Files\Lenovo\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\Lenovo\Bluetooth Software\btsendto_ie.htm () O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files\Lenovo\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\Lenovo\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: @C:\windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\Lenovo\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\Lenovo\Bluetooth Software\btsendto_ie.htm () O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 10.9.2) O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 10.9.2) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.200.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6D105475-D224-4456-9A55-B3798B25D40A}: DhcpNameServer = 192.168.200.1 O18:64bit: - Protocol\Handler\haufereader - No CLSID value found O18:64bit: - Protocol\Handler\livecall - No CLSID value found O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\msnim - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found O18 - Protocol\Handler\haufereader - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - AppInit_DLLs: (C:\Windows\System32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Programme\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.03.19 19:43:18 | 002,237,968 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Uli\Desktop\tdsskiller.exe [2013.03.19 18:58:47 | 004,745,728 | ---- | C] (AVAST Software) -- C:\Users\Uli\Desktop\aswMBR.exe [2013.03.15 18:39:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla [2013.03.15 18:39:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service [2013.03.14 19:06:56 | 000,000,000 | ---D | C] -- C:\windows\SysNative\SPReview [2013.03.14 18:43:02 | 000,116,224 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\windows\SysNative\fms.dll [2013.03.14 18:41:23 | 000,093,696 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\windows\SysWow64\fms.dll [2013.03.14 18:36:55 | 000,000,000 | ---D | C] -- C:\windows\SysNative\EventProviders [2013.03.14 09:35:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2013.03.14 09:34:48 | 002,347,384 | ---- | C] (ESET) -- C:\Users\Uli\Desktop\esetsmartinstaller_enu.exe [2013.03.14 09:24:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013.03.14 09:24:40 | 000,024,176 | ---- | C] (Malwarebytes Corporation) -- C:\windows\SysNative\drivers\mbam.sys [2013.03.14 09:24:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2013.03.13 19:43:13 | 000,000,000 | ---D | C] -- C:\windows\temp [2013.03.13 19:37:56 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN [2013.03.13 19:16:20 | 005,038,936 | R--- | C] (Swearware) -- C:\Users\Uli\Desktop\ComboFix.exe [2013.03.13 19:06:37 | 000,448,512 | ---- | C] (OldTimer Tools) -- C:\Users\Uli\Desktop\TFC.exe [2013.03.13 19:02:44 | 000,000,000 | ---D | C] -- C:\windows\ERUNT [2013.03.13 19:02:35 | 000,000,000 | ---D | C] -- C:\JRT [2013.03.13 19:00:48 | 000,550,572 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\Uli\Desktop\JRT.exe [2013.03.12 21:37:37 | 000,518,144 | ---- | C] (SteelWerX) -- C:\windows\SWREG.exe [2013.03.12 21:37:37 | 000,406,528 | ---- | C] (SteelWerX) -- C:\windows\SWSC.exe [2013.03.12 21:37:37 | 000,060,416 | ---- | C] (NirSoft) -- C:\windows\NIRCMD.exe [2013.03.12 21:00:03 | 000,000,000 | ---D | C] -- C:\Qoobox [2013.03.12 20:58:09 | 000,000,000 | ---D | C] -- C:\windows\erdnt [2013.03.11 18:00:02 | 000,000,000 | -HSD | C] -- C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F} [2013.03.11 18:00:02 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files [2013.03.11 15:43:19 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Uli\Desktop\OTL.exe [2013.03.11 10:11:28 | 000,000,000 | ---D | C] -- C:\Users\Uli\AppData\Roaming\Malwarebytes [2013.03.11 10:11:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.03.11 10:11:08 | 000,000,000 | ---D | C] -- C:\Users\Uli\AppData\Local\Programs [2013.02.22 18:18:05 | 000,000,000 | ---D | C] -- C:\Users\Uli\AppData\Roaming\Opera [2013.02.22 18:18:01 | 000,493,056 | ---- | C] ( datenhaus GmbH) -- C:\windows\SysWow64\dhRichClient3.dll ========== Files - Modified Within 30 Days ========== [2013.03.19 19:43:04 | 002,237,968 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Uli\Desktop\tdsskiller.exe [2013.03.19 19:08:03 | 000,183,363 | ---- | M] () -- C:\Users\Uli\Desktop\Fehlermeldung.png [2013.03.19 18:56:50 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Users\Uli\Desktop\aswMBR.exe [2013.03.19 16:10:28 | 001,509,054 | ---- | M] () -- C:\windows\SysNative\PerfStringBackup.INI [2013.03.19 16:10:28 | 000,658,150 | ---- | M] () -- C:\windows\SysNative\perfh007.dat [2013.03.19 16:10:28 | 000,619,426 | ---- | M] () -- C:\windows\SysNative\perfh009.dat [2013.03.19 16:10:28 | 000,131,264 | ---- | M] () -- C:\windows\SysNative\perfc007.dat [2013.03.19 16:10:28 | 000,107,488 | ---- | M] () -- C:\windows\SysNative\perfc009.dat [2013.03.19 16:06:00 | 000,067,584 | ---- | M] () -- C:\windows\bootstat.dat [2013.03.19 16:05:35 | 3010,797,568 | -HS- | M] () -- C:\hiberfil.sys [2013.03.15 15:23:20 | 000,000,884 | ---- | M] () -- C:\windows\tasks\Adobe Flash Player Updater.job [2013.03.14 19:31:37 | 000,013,424 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.03.14 19:31:37 | 000,013,424 | -H-- | M] () -- C:\windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.03.14 19:20:30 | 000,428,824 | ---- | M] () -- C:\windows\SysNative\FNTCACHE.DAT [2013.03.14 12:00:17 | 000,881,935 | ---- | M] () -- C:\Users\Uli\Desktop\SecurityCheck.exe [2013.03.14 09:34:48 | 002,347,384 | ---- | M] (ESET) -- C:\Users\Uli\Desktop\esetsmartinstaller_enu.exe [2013.03.14 09:24:41 | 000,001,073 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.03.13 19:37:47 | 000,000,027 | ---- | M] () -- C:\windows\SysNative\drivers\etc\hosts [2013.03.13 19:16:53 | 005,038,936 | R--- | M] (Swearware) -- C:\Users\Uli\Desktop\ComboFix.exe [2013.03.13 19:06:38 | 000,448,512 | ---- | M] (OldTimer Tools) -- C:\Users\Uli\Desktop\TFC.exe [2013.03.13 19:00:52 | 000,550,572 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\Uli\Desktop\JRT.exe [2013.03.13 18:50:14 | 000,597,667 | ---- | M] () -- C:\Users\Uli\Desktop\adwcleaner.exe [2013.03.11 16:00:02 | 000,377,856 | ---- | M] () -- C:\Users\Uli\Desktop\gmer_2.1.19155.exe [2013.03.11 15:43:20 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Uli\Desktop\OTL.exe [2013.03.11 15:40:53 | 000,000,000 | ---- | M] () -- C:\Users\Uli\defogger_reenable [2013.03.11 15:40:18 | 000,050,477 | ---- | M] () -- C:\Users\Uli\Desktop\Defogger.exe [2013.03.11 12:33:52 | 001,528,528 | ---- | M] () -- C:\windows\SysWow64\PerfStringBackup.INI [2013.03.05 21:45:24 | 493,084,541 | ---- | M] () -- C:\windows\MEMORY.DMP ========== Files Created - No Company Name ========== [2013.03.19 19:08:02 | 000,183,363 | ---- | C] () -- C:\Users\Uli\Desktop\Fehlermeldung.png [2013.03.14 18:43:27 | 000,347,904 | ---- | C] () -- C:\windows\SysNative\systemsf.ebd [2013.03.14 18:42:59 | 000,001,041 | ---- | C] () -- C:\windows\SysWow64\tcpbidi.xml [2013.03.14 18:41:31 | 000,105,559 | ---- | C] () -- C:\windows\SysWow64\RacRules.xml [2013.03.14 18:41:31 | 000,105,559 | ---- | C] () -- C:\windows\SysNative\RacRules.xml [2013.03.14 18:41:31 | 000,010,429 | ---- | C] () -- C:\windows\SysNative\ScavengeSpace.xml [2013.03.14 12:00:16 | 000,881,935 | ---- | C] () -- C:\Users\Uli\Desktop\SecurityCheck.exe [2013.03.14 09:24:41 | 000,001,073 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2013.03.13 18:50:13 | 000,597,667 | ---- | C] () -- C:\Users\Uli\Desktop\adwcleaner.exe [2013.03.12 21:37:37 | 000,256,000 | ---- | C] () -- C:\windows\PEV.exe [2013.03.12 21:37:37 | 000,208,896 | ---- | C] () -- C:\windows\MBR.exe [2013.03.12 21:37:37 | 000,098,816 | ---- | C] () -- C:\windows\sed.exe [2013.03.12 21:37:37 | 000,080,412 | ---- | C] () -- C:\windows\grep.exe [2013.03.12 21:37:37 | 000,068,096 | ---- | C] () -- C:\windows\zip.exe [2013.03.11 16:00:02 | 000,377,856 | ---- | C] () -- C:\Users\Uli\Desktop\gmer_2.1.19155.exe [2013.03.11 15:40:53 | 000,000,000 | ---- | C] () -- C:\Users\Uli\defogger_reenable [2013.03.11 15:40:17 | 000,050,477 | ---- | C] () -- C:\Users\Uli\Desktop\Defogger.exe [2013.02.22 18:18:01 | 000,338,432 | ---- | C] () -- C:\windows\SysWow64\sqlite36_engine.dll [2013.02.18 17:38:58 | 493,084,541 | ---- | C] () -- C:\windows\MEMORY.DMP [2013.01.17 14:53:49 | 000,005,632 | ---- | C] () -- C:\Users\Uli\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.05.10 16:59:33 | 000,000,636 | ---- | C] () -- C:\windows\wiso.ini [2011.08.31 17:29:33 | 000,000,120 | ---- | C] () -- C:\Users\Uli\AppData\Local\Uzoxikijirazo.dat [2011.08.31 17:29:33 | 000,000,000 | ---- | C] () -- C:\Users\Uli\AppData\Local\Ovaqujuqodihodu.bin [2011.07.24 14:23:03 | 000,000,041 | -HS- | C] () -- C:\ProgramData\.zreglib [2011.07.08 10:53:43 | 000,000,035 | ---- | C] () -- C:\windows\A5W.INI [2011.06.22 17:10:55 | 000,482,408 | ---- | C] () -- C:\windows\SSndii.exe [2011.06.22 17:08:14 | 000,113,768 | ---- | C] () -- C:\windows\Wiainst.exe [2011.04.09 12:02:16 | 001,528,528 | ---- | C] () -- C:\windows\SysWow64\PerfStringBackup.INI [2011.02.13 10:37:29 | 000,000,088 | ---- | C] () -- C:\ProgramData\profile.xml ========== ZeroAccess Check ========== [2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 04:19:04 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2011.02.13 12:02:32 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\IrfanView [2011.05.07 09:34:27 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\Lexware [2011.10.27 16:31:39 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\SoftGrid Client [2011.06.05 20:43:23 | 000,000,000 | ---D | M] -- C:\Users\Alex\AppData\Roaming\Thunderbird [2012.05.10 17:01:56 | 000,000,000 | ---D | M] -- C:\Users\Uli\AppData\Roaming\Buhl Data Service [2011.07.24 14:13:27 | 000,000,000 | ---D | M] -- C:\Users\Uli\AppData\Roaming\Canneverbe Limited [2013.01.29 18:30:23 | 000,000,000 | ---D | M] -- C:\Users\Uli\AppData\Roaming\Dropbox [2012.03.04 19:29:01 | 000,000,000 | ---D | M] -- C:\Users\Uli\AppData\Roaming\Giyzuzw [2011.04.02 11:50:59 | 000,000,000 | ---D | M] -- C:\Users\Uli\AppData\Roaming\Intermedia Software [2012.09.08 13:17:29 | 000,000,000 | ---D | M] -- C:\Users\Uli\AppData\Roaming\IrfanView [2012.03.04 19:38:04 | 000,000,000 | ---D | M] -- C:\Users\Uli\AppData\Roaming\Kuuszec [2011.05.09 17:49:59 | 000,000,000 | ---D | M] -- C:\Users\Uli\AppData\Roaming\Lexware [2012.09.17 08:56:33 | 000,000,000 | ---D | M] -- C:\Users\Uli\AppData\Roaming\MyPhoneExplorer [2013.02.22 18:18:05 | 000,000,000 | ---D | M] -- C:\Users\Uli\AppData\Roaming\Opera [2011.06.22 17:26:03 | 000,000,000 | ---D | M] -- C:\Users\Uli\AppData\Roaming\SoftGrid Client [2011.04.09 12:02:59 | 000,000,000 | ---D | M] -- C:\Users\Uli\AppData\Roaming\TP [2013.03.13 19:30:52 | 000,000,000 | ---D | M] -- C:\Users\Uli\AppData\Roaming\xplugin ========== Purity Check ========== < End of report > Grüße |
|
19.03.2013, 21:51
| #21 |
| /// TB-Ausbilder | Nach Malwarebytes-Suche fährt Windows nicht mehr hoch Also das ist wirklich sehr mysteriös. Wir probieren das nochmal anders: Scan mit MBAR Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ --> Nach Malwarebytes-Suche fährt Windows nicht mehr hoch |
|
21.03.2013, 15:22
| #22 |
| | Nach Malwarebytes-Suche fährt Windows nicht mehr hoch Hi. Sorry, hat ein wenig gedauert. Das Anti-Rootkit-Programm hat keine Malware gefunde... Hier das Logfile: Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.01.0.1021
www.malwarebytes.org
Database version: v2013.03.21.08
Windows 7 Service Pack 1 x64 NTFS (Safe Mode/Networking)
Internet Explorer 9.0.8112.16421
Uli :: ALEX-PC [administrator]
21.03.2013 15:20:03
mbar-log-2013-03-21 (15-20-03).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 29913
Time elapsed: 10 minute(s), 37 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
Grüße sgeuli |
|
21.03.2013, 18:47
| #23 |
| /// TB-Ausbilder | Nach Malwarebytes-Suche fährt Windows nicht mehr hoch Das ist wirklich spannend. Also gut, das letzte das mir jetzt noch einfällt ... deinstalliere mal Malwarebytes und schau ob sich das ändert.
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
22.03.2013, 16:54
| #24 |
| | Nach Malwarebytes-Suche fährt Windows nicht mehr hoch Hi ryder, oh Wunder, das hat geholfen. Seit dem ich Malwarebyte deinstalliert habe funktioniert Windows wieder. Es hat sich, wegen des Windows Service Packetes noch ein paar mal hoch und runter gefahren, jetzt scheint es wieder zu laufen, es kommt mir jedoch ein wenig langsam vor... Aber gut... Liegt veilleicht am Service Packet. Gruß Uli |
|
22.03.2013, 17:00
| #25 |
| /// TB-Ausbilder | Nach Malwarebytes-Suche fährt Windows nicht mehr hoch Glaub ich eher weniger. Versuchen wir das mal herauszufinden: Drücke bitte die  + R Taste und schreibe notepad in das Ausführen Fenster.Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter >checkDMA.txt 2>&1 (
reg query "HKLM\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0"
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}" /s
)
notepad checkDMA.txt
Kopiere mir das Logfile hier in den Thread.
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
22.03.2013, 17:05
| #26 |
| | Nach Malwarebytes-Suche fährt Windows nicht mehr hoch Okay, alles klar. Hier das log: Code:
ATTFilter HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0
DMAEnabled REG_DWORD 0x1
Driver REG_SZ iaStor
HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}
Class REG_SZ hdc
ClassDesc REG_SZ @%SystemRoot%\System32\SysClass.Dll,-3001
(Standard) REG_SZ IDE ATA/ATAPI controllers
IconPath REG_MULTI_SZ %SystemRoot%\System32\setupapi.dll,-9
Installer32 REG_SZ SysClass.Dll,HdcClassInstaller
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0000
CoInstallers32 REG_MULTI_SZ storprop.dll,HdcCoInstaller
EnumPropPages32 REG_SZ storprop.dll,AtaPropPageProvider
InfPath REG_SZ mshdc.inf
InfSection REG_SZ atapi_Inst
ProviderName REG_SZ Microsoft
DriverDateData REG_BINARY 00808CA3C594C601
DriverDate REG_SZ 6-21-2006
DriverVersion REG_SZ 6.1.7601.17514
MatchingDeviceId REG_SZ internal_ide_channel
DriverDesc REG_SZ IDE-Kanal
Migrated REG_DWORD 0x1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0001
InfPath REG_SZ oem7.inf
InfSection REG_SZ iaStor_mobl_Inst
ProviderName REG_SZ Intel
DriverDateData REG_BINARY 00C0A07764BACA01
DriverDate REG_SZ 3-3-2010
DriverVersion REG_SZ 9.6.0.1014
MatchingDeviceId REG_SZ pci\ven_8086&dev_3b29&cc_0106
DriverDesc REG_SZ Intel(R) 5 Series 4 Port SATA AHCI Controller
Migrated REG_DWORD 0x1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0002
CoInstallers32 REG_MULTI_SZ storprop.dll,HdcCoInstaller
EnumPropPages32 REG_SZ storprop.dll,AtaPropPageProvider
InfPath REG_SZ mshdc.inf
InfSection REG_SZ atapi_Inst
ProviderName REG_SZ Microsoft
DriverDateData REG_BINARY 00808CA3C594C601
DriverDate REG_SZ 6-21-2006
DriverVersion REG_SZ 6.1.7601.17514
MatchingDeviceId REG_SZ internal_ide_channel
DriverDesc REG_SZ IDE-Kanal
Migrated REG_DWORD 0x1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\0003
CoInstallers32 REG_MULTI_SZ storprop.dll,HdcCoInstaller
EnumPropPages32 REG_SZ storprop.dll,AtaPropPageProvider
InfPath REG_SZ mshdc.inf
InfSection REG_SZ atapi_Inst
ProviderName REG_SZ Microsoft
DriverDateData REG_BINARY 00808CA3C594C601
DriverDate REG_SZ 6-21-2006
DriverVersion REG_SZ 6.1.7601.17514
MatchingDeviceId REG_SZ internal_ide_channel
DriverDesc REG_SZ IDE-Kanal
Migrated REG_DWORD 0x1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties
|
|
22.03.2013, 17:07
| #27 |
| /// TB-Ausbilder | Nach Malwarebytes-Suche fährt Windows nicht mehr hoch Nein das sieht eigentlich sehr gut aus. Sei bitte so nett und mach mal den Test. Installiere MBAM nochmals. Kommen die Probleme sofort zurück?
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
22.03.2013, 17:23
| #28 |
| | Nach Malwarebytes-Suche fährt Windows nicht mehr hoch HI, hab MAlwarebyte wieder installiert, keinen Suchlauf gemacht, sondern direkt PC runter und wieder hoch gefahren und siehe da, WIndows bleibt hängen. Windows Oberfläche erscheint noch, aber dann ist schluß. Kaltstart, abgesicherter Modus und hier bin ich nun zurück... Gruß sgeUli |
|
22.03.2013, 17:23
| #29 |
| /// TB-Ausbilder | Nach Malwarebytes-Suche fährt Windows nicht mehr hoch Hm wirklich spannend. Gut bitte deinstallieren und danke für den Test.
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
22.03.2013, 17:32
| #30 |
| | Nach Malwarebytes-Suche fährt Windows nicht mehr hoch Jo, alles klar, deinstalliert und es klappt wieder... |
|
| Themen zu Nach Malwarebytes-Suche fährt Windows nicht mehr hoch |
| 1clickdownload, administrator, adobe, antivir, application/pdf:, autorun, avira, bho, error, excel, explorer, fehler, firefox, flash player, format, gfiltersvc.exe, home, install.exe, lenovo, malwarebytes pc-absturz, mozilla, nvidia, nvpciflt.sys, plug-in, pmmupdate.exe, port, realtek, registry, richtlinie, rundll, safer networking, security, software, svchost.exe, tracker, trojan.agent.ge, udp, windows |
Linear-Darstellung
