| |
| |||||||
Log-Analyse und Auswertung: Nach Hotelbesuch braucht PC ewig bis Internet und weitere Programme startenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
18.05.2013, 21:51
| #1 |
 |  Nach Hotelbesuch braucht PC ewig bis Internet und weitere Programme starten Hallo Leute, ich bitte Euch um Eure Erfahrung. Nachdem ich in einem Hotel das Wireless Lan Netzt genutzt hatte gings schon kurze Zeit später los mit Leistungsproblemen. Laptop fährt hoch, Firefox und co brauchen aber gefühlt eine Ewigkeit bis es losgehen kann (minimum 1-2min). Hatt auch russiche, schwedisch und polnische microsoft net items unter Systemprogramme, die ich mittels deinstallieren entfernt habe (oder auch nicht) Hier die Logfiles:OTL Logfile: Code:
ATTFilter OTL logfile created on: 18.05.2013 22:09:10 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\T\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,95 Gb Total Physical Memory | 1,94 Gb Available Physical Memory | 49,21% Memory free 7,90 Gb Paging File | 5,50 Gb Available in Paging File | 69,64% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 451,56 Gb Total Space | 398,79 Gb Free Space | 88,31% Space Free | Partition Type: NTFS Computer Name: T-VAIO | User Name: T | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.05.18 21:52:57 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\T\Downloads\OTL.exe PRC - [2013.02.20 20:20:09 | 001,151,152 | ---- | M] () -- C:\Program Files (x86)\AVG Secure Search\vprot.exe PRC - [2013.02.20 20:20:09 | 000,968,880 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe PRC - [2012.12.18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2012.11.03 14:45:13 | 000,206,448 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe PRC - [2012.06.11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe PRC - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe PRC - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe PRC - [2011.04.29 18:20:18 | 000,146,592 | ---- | M] (Atheros) -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe PRC - [2011.03.05 17:42:36 | 000,180,928 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe PRC - [2011.03.05 17:42:36 | 000,064,704 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe PRC - [2011.02.23 15:05:04 | 000,105,024 | ---- | M] (ArcSoft, Inc.) -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe PRC - [2011.02.15 12:47:02 | 002,757,312 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe PRC - [2011.02.14 14:23:50 | 000,044,736 | ---- | M] (Sony Corporation) -- C:\Programme\Sony\VAIO Care\VCService.exe PRC - [2011.02.01 14:20:48 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2011.02.01 14:20:46 | 000,326,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe PRC - [2011.01.29 06:36:18 | 000,081,016 | ---- | M] (Sony of America Corporation) -- C:\Programme\Sony\VAIO Care\listener.exe PRC - [2010.11.27 01:55:42 | 000,648,032 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe PRC - [2010.11.27 01:55:42 | 000,398,176 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe PRC - [2010.09.13 19:32:32 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe PRC - [2010.09.13 19:32:30 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe PRC - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe PRC - [2010.02.28 02:33:14 | 000,077,664 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe PRC - [2008.11.04 11:40:24 | 002,087,424 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe PRC - [2008.11.04 11:39:20 | 000,014,336 | ---- | M] (Vodafone) -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe ========== Modules (No Company Name) ========== MOD - [2013.02.20 20:20:09 | 001,151,152 | ---- | M] () -- C:\Program Files (x86)\AVG Secure Search\vprot.exe MOD - [2013.02.20 20:20:09 | 000,156,848 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\SiteSafety.dll MOD - [2012.12.12 07:32:26 | 005,025,792 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll MOD - [2012.10.05 12:53:24 | 003,198,976 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll MOD - [2012.10.05 12:53:24 | 000,630,784 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll MOD - [2012.10.05 12:53:24 | 000,258,048 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll MOD - [2012.08.31 12:59:19 | 004,550,656 | ---- | M] () -- C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll MOD - [2012.02.14 02:17:31 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll MOD - [2012.02.11 01:31:42 | 001,253,376 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\WindowsBase\3.0.0.0__31bf3856ad364e35\WindowsBase.dll MOD - [2011.12.25 22:42:15 | 005,255,168 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll MOD - [2011.04.24 23:13:30 | 007,008,656 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtGui4.dll MOD - [2011.04.24 23:13:28 | 000,192,912 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtSql4.dll MOD - [2011.04.24 23:13:26 | 001,270,160 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtScript4.dll MOD - [2011.04.24 23:13:26 | 000,758,160 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtNetwork4.dll MOD - [2011.04.24 23:13:24 | 002,118,032 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtCore4.dll MOD - [2011.04.24 23:13:24 | 002,089,360 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtDeclarative4.dll MOD - [2011.04.20 19:56:28 | 000,025,088 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\imageformats\qgif4.dll MOD - [2010.11.21 05:24:32 | 000,425,984 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll MOD - [2010.11.21 05:24:25 | 000,385,024 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll MOD - [2010.11.21 05:24:08 | 002,927,616 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll MOD - [2010.11.21 05:23:56 | 000,114,688 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll MOD - [2010.11.21 05:23:48 | 002,048,000 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll MOD - [2010.11.21 05:23:48 | 000,303,104 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll MOD - [2010.11.13 01:26:08 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2010.02.28 02:33:14 | 000,077,664 | ---- | M] () -- C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe MOD - [2009.07.14 03:15:45 | 000,364,544 | ---- | M] () -- C:\Windows\SysWOW64\msjetoledb40.dll MOD - [2009.06.10 23:23:19 | 000,261,632 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll MOD - [2009.06.10 23:22:40 | 000,010,752 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll ========== Services (SafeList) ========== SRV:64bit: - [2011.01.29 06:36:18 | 000,259,192 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Care\VCPerfService.exe -- (SampleCollector) SRV - [2013.05.18 21:51:45 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013.04.12 16:39:36 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.02.20 20:20:09 | 000,968,880 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe -- (vToolbarUpdater14.2.0) SRV - [2012.12.18 21:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.11.03 14:45:13 | 000,206,448 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe -- (AVP) SRV - [2012.06.11 16:22:16 | 000,240,208 | ---- | M] (Microsoft Corporation.) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe -- (BBUpdate) SRV - [2012.06.11 16:22:16 | 000,193,616 | ---- | M] (Microsoft Corporation.) [Auto | Stopped] -- C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe -- (BBSvc) SRV - [2011.10.01 08:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa) SRV - [2011.10.01 08:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist) SRV - [2011.05.19 20:15:44 | 000,549,616 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Programme\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe -- (VcmIAlzMgr) SRV - [2011.04.29 18:20:18 | 000,146,592 | ---- | M] (Atheros) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe -- (Atheros Bt&Wlan Coex Agent) SRV - [2011.04.29 18:19:22 | 000,091,296 | ---- | M] (Atheros Commnucations) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe -- (AtherosSvc) SRV - [2011.03.30 10:09:12 | 001,021,112 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Programme\Sony\VAIO Update 5\VUAgent.exe -- (VUAgent) SRV - [2011.03.29 08:13:25 | 002,361,344 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe -- (IconMan_R) SRV - [2011.03.05 17:42:36 | 000,064,704 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service) SRV - [2011.02.28 11:29:18 | 000,852,160 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Programme\Sony\VAIO Smart Network\VSNService.exe -- (VSNService) SRV - [2011.02.23 15:05:04 | 000,105,024 | ---- | M] (ArcSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe -- (uCamMonitor) SRV - [2011.02.21 13:55:08 | 000,113,824 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe -- (SOHCImp) SRV - [2011.02.21 13:55:08 | 000,067,232 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe -- (SOHDs) SRV - [2011.02.18 23:15:06 | 000,099,104 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe -- (VcmXmlIfHelper) SRV - [2011.02.18 23:02:08 | 000,385,336 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Programme\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe -- (VcmINSMgr) SRV - [2011.02.14 14:23:50 | 000,044,736 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Programme\Sony\VAIO Care\VCService.exe -- (VCService) SRV - [2011.02.01 14:20:48 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2011.02.01 14:20:46 | 000,326,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2011.01.20 13:27:18 | 000,286,936 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe -- (SpfService) SRV - [2011.01.20 13:16:26 | 000,887,000 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe -- (VCFw) SRV - [2010.11.27 01:55:42 | 000,398,176 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe -- (PMBDeviceInfoProvider) SRV - [2010.09.13 19:32:32 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010.03.18 12:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon) SRV - [2010.01.09 21:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2008.11.04 11:39:20 | 000,014,336 | ---- | M] (Vodafone) [Auto | Running] -- C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe -- (VMCService) ========== Driver Services (SafeList) ========== OTL Extras logfile created on: 18.05.2013 22:09:10 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\T\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,95 Gb Total Physical Memory | 1,94 Gb Available Physical Memory | 49,21% Memory free 7,90 Gb Paging File | 5,50 Gb Available in Paging File | 69,64% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 451,56 Gb Total Space | 398,79 Gb Free Space | 88,31% Space Free | Partition Type: NTFS Computer Name: T-VAIO | User Name: T | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- Reg Error: Key error. htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1" inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{199BE382-E5B6-4149-9FB4-4B2BE1426C8A}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{2EEAAE20-0887-4E3E-9ECB-4F6CFCDBD55D}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=%systemroot%\microsoft.net\framework64\v3.0\windows communication foundation\smsvchost.exe | "{36631B96-24ED-43E6-BB1F-13867F9A2ACC}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{475DFE09-3105-43F4-A1BF-AF58B6869C3E}" = rport=137 | protocol=17 | dir=out | app=system | "{7C9FC3AA-1718-4AFD-88CD-FA38CFF04FEC}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{955CFA28-0799-40FB-9ED4-A2C5239B6E03}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{989882DA-B4C8-40C6-894F-B8D3039A4552}" = lport=138 | protocol=17 | dir=in | app=system | "{D6C6BC83-3D3D-4F8C-87C1-A137A5A678A0}" = lport=445 | protocol=6 | dir=in | app=system | "{D6F11C38-FFBE-4A9C-B5AD-F9B99D410D9D}" = rport=445 | protocol=6 | dir=out | app=system | "{EDB65ED6-183F-478C-A012-4AA90AEFB136}" = lport=139 | protocol=6 | dir=in | app=system | "{F9BC6ACF-9C4A-43D2-A8D5-F19E17EA533E}" = lport=137 | protocol=17 | dir=in | app=system | "{FE7C8191-26F8-4820-A3DB-AF2854C8C9F8}" = rport=139 | protocol=6 | dir=out | app=system | "{FE8ACA26-5F66-4C2A-8C43-372967EFE157}" = rport=138 | protocol=17 | dir=out | app=system | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0E5CE0A0-BE49-42A2-8D27-9886645512FD}" = protocol=17 | dir=in | app=c:\program files\sony\vaio care\selfhealupdate.exe | "{25B64702-F5A8-4F20-985E-6DD4FA8B94F6}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{31534817-B411-460B-AA7F-597899DA3493}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe | "{36DE9E61-1A03-4453-ABBE-D9BB89D9DCF5}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{3CC5042D-5FE1-4E01-9913-A54365F0D21B}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{520872CE-AFF7-45EC-B352-9FAE99D00E0C}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe | "{535E0621-F6DE-4C66-9054-FBE4DD3CE26C}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{59C61CCA-788A-4625-A881-8BBD37D8BD79}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{6B87C91A-503E-4DB5-A24C-489835667ABF}" = protocol=17 | dir=in | app=c:\program files\sony\vaio care\vcagent.exe | "{88D30A78-9A73-42EC-859E-E68353CE5A6F}" = protocol=6 | dir=in | app=c:\program files\sony\vaio care\selfhealupdate.exe | "{BADA73F5-8074-4E29-8A0B-A030BB4C5805}" = protocol=6 | dir=in | app=c:\program files\sony\vaio care\vcagent.exe | "{C416A0CA-15C0-4D23-A432-C5884619AA1F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{D1415239-C96D-43E8-B96C-5464D834DE56}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{D4C3D11A-EADC-4671-9293-A3622D2F8C79}" = protocol=6 | dir=in | app=c:\program files\sony\vaio care\vaiocaremain.exe | "{E60E0772-CAB0-4D36-BF25-0935316B0785}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{E6EAE20D-4403-4801-8D2E-374ED1E25BCC}" = protocol=17 | dir=in | app=c:\program files\sony\vaio care\vaiocaremain.exe | "{EEB31451-0A16-44C0-B4DC-E61F6AB4A746}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{F99CFC2B-AABA-4281-9991-55ACA4F7AB68}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{115B60D5-BBDB-490E-AF2E-064D37A3CE01}" = Media Gallery "{133D3F07-D558-46CE-80E8-F4D75DBBAD63}" = PMB VAIO Edition Plug-in "{230D1595-57DA-4933-8C4E-375797EBB7E1}" = Bluetooth Win7 Suite (64) "{26A24AE4-039D-4CA4-87B4-2F86416022FF}" = Java(TM) 6 Update 22 (64-bit) "{312395BC-7CC2-434C-A660-30250276A926}" = SSLx64 "{4F31AC31-0A28-4F5A-8416-513972DA1F79}" = Sony Corporation "{75C95C84-264F-4CC7-8A7E-346444E6C7C1}" = VAIO Improvement Validation "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{90140000-006D-0407-1000-0000000FF1CE}" = Microsoft Office Klick-und-Los 2010 "{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting "{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Alps Pointing-device for VAIO "{D55EAC07-7207-44BD-B524-0F063F327743}" = VIx64 "{F1DC5C16-9B1F-467B-85E3-CB48C27AC50D}" = VESx64 "{F2611404-06BF-4E67-A5B7-8DB2FFC1CBF6}" = VSNx64 "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "CNXT_AUDIO_HDA" = Conexant HD Audio "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{046885A1-B4AE-4459-A0D1-8C93706698D6}" = "{07441A52-E208-478A-92B7-5C337CA8C131}" = VAIO - Remote Play mit PlayStation®3 "{0899D75A-C2FC-42EA-A702-5B9A5F24EAD5}" = VAIO Smart Network "{08D7BC86-7358-464C-8AD0-0D84B5F0A0C9}" = Remote Keyboard "{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser "{1AE46C09-2AB8-4EE5-88FB-08CD0FF7F2DF}" = Bing Bar "{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 22 "{270380EB-8812-42E1-8289-53700DB840D2}" = PMB VAIO Edition Plug-in "{36C5BBF0-E5BF-4DE1-B684-7E90B0C93FB5}" = VAIO Care "{3A26D9BD-0F73-432D-B522-2BA18138F7EF}" = VAIO Improvement "{3A94F54D-A8A4-4B82-B346-92B4D56A2708}" = VESx86 "{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology "{45E557D6-2271-4F13-8101-C620B4285AB0}" = Kaspersky Internet Security 2012 "{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{547C9EB4-4CA6-402F-9D1B-8BD30DC71E44}" = VAIO Sample Contents "{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}" = VAIO Data Restore Tool "{5A92468F-3ED8-4F96-A9E1-4F176C80EC29}" = VAIO Quick Web Access "{5BEE8F1F-BD32-4553-8107-500439E43BD7}" = VAIO Update "{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}" = VAIO-Support für Übertragungen "{5FA51AAF-23FE-42F4-A724-D79F85F41D4B}" = Remote Play with PlayStation 3 "{61438020-DDD4-42FA-99A2-50225441980A}" = ArcSoft Magic-i Visual Effects 2 "{63C43435-F428-42BA-8E7B-5848749D9262}" = SSLx86 "{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components "{66081CDD-C1FE-415F-BB3A-F2622BA27461}" = PMB VAIO Edition Guide "{70991E0A-1108-437E-BA7D-085702C670C0}" = "{70EED410-697B-4193-A2CB-2F790F82B420}" = VAIO Data Restore Tool "{72042FA6-5609-489F-A8EA-3C2DD650F667}" = VAIO Control Center "{7396FB15-9AB4-4B78-BDD8-24A9C15D2C65}" = VAIO - Remote-Tastatur "{73D8886A-D416-4687-B609-0D3836BA410C}" = VAIO Event Service "{7C80D30A-AC02-4E3F-B95D-29F0E4FF937B}" = VAIO Easy Connect "{82F09B1C-F602-4552-9C40-5BD5F8EAF750}" = "{8356CB97-A48F-44CB-837A-A12838DC4669}" = PMB VAIO Edition Plug-in "{855DDD3C-131E-42A8-BCBD-F9581F80CACB}" = "{8B3776EC-5F0A-4996-A7DF-BB5DA95B240E}" = Vodafone Mobile Connect Lite "{90140011-0066-0407-0000-0000000FF1CE}" = Microsoft Office Starter 2010 - Deutsch "{91989CE7-EE83-4A53-8E06-D97887928119}" = VAIO Care "{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010 "{9B088046-8A01-4355-99DD-8530C022F682}" = VCCx86 "{A7C30414-2382-4086-B0D6-01A88ABA21C3}" = VAIO Gate "{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.02) - Deutsch "{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}" = PMB "{B7546697-2A80-4256-A24B-1C33163F535B}" = VAIO Gate Default "{B8991D99-88FD-41F2-8C32-DB70278D5C30}" = VWSTx86 "{C1594429-8296-4652-BF54-9DBE4932A44C}" = Realtek PCIE Card Reader "{C6E893E7-E5EA-4CD5-917C-5443E753FCBD}" = VAIO-Handbuch "{C72E35E5-C5C6-4328-AD9A-BBCCC816A2E6}" = VAIO Hardware Diagnostics "{C793AD32-2BB8-4CC4-ABD3-A1469C21593C}" = ArcSoft WebCam Companion 4 "{D17C2A58-E0EA-4DD7-A2D6-C448FD25B6F6}" = VIx86 "{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics "{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center "{FA870BF1-44A1-4B7D-93E1-C101369AF0C1}" = VAIO - Media Gallery "Adobe AIR" = Adobe AIR "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "AVG Secure Search" = AVG Security Toolbar "HD Tune_is1" = HD Tune 2.55 "InstallShield_{270380EB-8812-42E1-8289-53700DB840D2}" = VAIO - PMB VAIO Edition Plug-in "InstallShield_{66081CDD-C1FE-415F-BB3A-F2622BA27461}" = VAIO - PMB VAIO Edition Guide "InstallShield_{7C80D30A-AC02-4E3F-B95D-29F0E4FF937B}" = VAIO Easy Connect "InstallWIX_{45E557D6-2271-4F13-8101-C620B4285AB0}" = Kaspersky Internet Security 2012 "Mozilla Firefox 20.0.1 (x86 de)" = Mozilla Firefox 20.0.1 (x86 de) "MozillaMaintenanceService" = Mozilla Maintenance Service "Office14.Click2Run" = Microsoft Office Klick-und-Los 2010 "splashtop" = VAIO Quick Web Access "Sweet Home 3D_is1" = Sweet Home 3D version 3.6 "VAIO Help and Support" = "VAIO Hero Screensaver - Summer 2011 Screensaver" = VAIO Hero Screensaver - Summer 2011 Screensaver ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 26.03.2013 16:43:27 | Computer Name = T-VAIO | Source = VMCService | ID = 0 Description = conflictManagerTypeValue Error - 26.03.2013 16:45:02 | Computer Name = T-VAIO | Source = WinMgmt | ID = 10 Description = Error - 27.03.2013 14:48:28 | Computer Name = T-VAIO | Source = VMCService | ID = 0 Description = conflictManagerTypeValue Error - 27.03.2013 14:48:44 | Computer Name = T-VAIO | Source = Application Error | ID = 1000 Description = Name der fehlerhaften Anwendung: svchost.exe_LanmanServer, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc3c1 Name des fehlerhaften Moduls: SSCORE.DLL, Version: 6.1.7601.17514, Zeitstempel: 0x4ce7c9ec Ausnahmecode: 0xc0000005 Fehleroffset: 0x000000000000146d ID des fehlerhaften Prozesses: 0x21c Startzeit der fehlerhaften Anwendung: 0x01ce2b1baa532dcc Pfad der fehlerhaften Anwendung: C:\Windows\system32\svchost.exe Pfad des fehlerhaften Moduls: C:\Windows\system32\SSCORE.DLL Berichtskennung: f3026843-970e-11e2-8f9a-78843cfd4fea Error - 27.03.2013 14:50:05 | Computer Name = T-VAIO | Source = WinMgmt | ID = 10 Description = Error - 27.03.2013 15:39:46 | Computer Name = T-VAIO | Source = VMCService | ID = 0 Description = conflictManagerTypeValue Error - 27.03.2013 15:39:52 | Computer Name = T-VAIO | Source = VMCService | ID = 0 Description = GetLoggedOnUser Error - 27.03.2013 15:39:56 | Computer Name = T-VAIO | Source = VMCService | ID = 0 Description = GetLoggedOnUser Error - 27.03.2013 15:40:00 | Computer Name = T-VAIO | Source = VMCService | ID = 0 Description = GetLoggedOnUser Error - 27.03.2013 15:41:19 | Computer Name = T-VAIO | Source = WinMgmt | ID = 10 Description = [ Media Center Events ] Error - 30.09.2012 12:09:04 | Computer Name = T-VAIO | Source = MCUpdate | ID = 0 Description = 18:09:04 - Fehler beim Herstellen der Internetverbindung. 18:09:04 - Serververbindung konnte nicht hergestellt werden.. Error - 30.09.2012 12:09:14 | Computer Name = T-VAIO | Source = MCUpdate | ID = 0 Description = 18:09:09 - Fehler beim Herstellen der Internetverbindung. 18:09:09 - Serververbindung konnte nicht hergestellt werden.. Error - 30.09.2012 15:18:02 | Computer Name = T-VAIO | Source = MCUpdate | ID = 0 Description = 21:18:02 - Fehler beim Herstellen der Internetverbindung. 21:18:02 - Serververbindung konnte nicht hergestellt werden.. Error - 30.09.2012 15:18:13 | Computer Name = T-VAIO | Source = MCUpdate | ID = 0 Description = 21:18:08 - Fehler beim Herstellen der Internetverbindung. 21:18:08 - Serververbindung konnte nicht hergestellt werden.. Error - 30.09.2012 16:18:18 | Computer Name = T-VAIO | Source = MCUpdate | ID = 0 Description = 22:18:18 - Fehler beim Herstellen der Internetverbindung. 22:18:18 - Serververbindung konnte nicht hergestellt werden.. Error - 30.09.2012 16:18:24 | Computer Name = T-VAIO | Source = MCUpdate | ID = 0 Description = 22:18:23 - Fehler beim Herstellen der Internetverbindung. 22:18:23 - Serververbindung konnte nicht hergestellt werden.. Error - 01.10.2012 15:28:12 | Computer Name = T-VAIO | Source = MCUpdate | ID = 0 Description = 21:28:12 - Fehler beim Herstellen der Internetverbindung. 21:28:12 - Serververbindung konnte nicht hergestellt werden.. Error - 01.10.2012 15:28:22 | Computer Name = T-VAIO | Source = MCUpdate | ID = 0 Description = 21:28:17 - Fehler beim Herstellen der Internetverbindung. 21:28:17 - Serververbindung konnte nicht hergestellt werden.. Error - 02.10.2012 15:01:00 | Computer Name = T-VAIO | Source = MCUpdate | ID = 0 Description = 21:01:00 - Fehler beim Herstellen der Internetverbindung. 21:01:00 - Serververbindung konnte nicht hergestellt werden.. Error - 02.10.2012 15:01:11 | Computer Name = T-VAIO | Source = MCUpdate | ID = 0 Description = 21:01:05 - Fehler beim Herstellen der Internetverbindung. 21:01:05 - Serververbindung konnte nicht hergestellt werden.. [ System Events ] Error - 17.05.2013 11:52:34 | Computer Name = T-VAIO | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20 Description = Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Update für Microsoft .NET Framework 4 unter Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008, Windows Server 2008 R2 für x64-basierte Systeme (KB2468871) Error - 17.05.2013 11:54:52 | Computer Name = T-VAIO | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20 Description = Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Sicherheitsupdate für Microsoft .NET Framework 4 unter Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008, Windows Server 2008 R2 für x64-basierte Systeme (KB2742595) Error - 18.05.2013 15:02:23 | Computer Name = T-VAIO | Source = BTHUSB | ID = 327697 Description = Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen. Error - 18.05.2013 15:04:51 | Computer Name = T-VAIO | Source = Service Control Manager | ID = 7009 Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht. Error - 18.05.2013 15:05:28 | Computer Name = T-VAIO | Source = DCOM | ID = 10010 Description = Error - 18.05.2013 15:05:38 | Computer Name = T-VAIO | Source = Service Control Manager | ID = 7009 Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht. Error - 18.05.2013 15:05:42 | Computer Name = T-VAIO | Source = Service Control Manager | ID = 7011 Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SysMain erreicht. Error - 18.05.2013 15:07:08 | Computer Name = T-VAIO | Source = Service Control Manager | ID = 7022 Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" wurde nicht richtig gestartet. Error - 18.05.2013 15:07:45 | Computer Name = T-VAIO | Source = Service Control Manager | ID = 7009 Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht. Error - 18.05.2013 15:10:48 | Computer Name = T-VAIO | Source = Server | ID = 2505 Description = Aufgrund eines doppelten Netzwerknamens konnte zu der Transportschicht \Device\NetBT_Tcpip_{F14747C5-9281-4867-913F-957214D1A303} vom Serverdienst nicht gebunden werden. Der Serverdienst konnte nicht gestartet werden. < End of report > GMER Logfile: Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-05-18 22:36:01
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GT00 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\T\AppData\Local\Temp\pxldipow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560 fffff80002ff5000 8 bytes [00, 00, 0D, 02, 4B, 4C, 73, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 569 fffff80002ff5009 54 bytes [D5, E8, 03, 80, FA, FF, FF, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2204] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2204] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe[3292] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe[3292] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\AVG Secure Search\vprot.exe[3416] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\AVG Secure Search\vprot.exe[3416] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe[5512] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[4584] C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe!?SparseBitMask@DataSourceDescription@FlexUI@@2HB + 960 000000002dcb5984 4 bytes [4F, F7, AF, AA]
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[4584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077741465 2 bytes [74, 77]
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\cvh.exe[4584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000777414bb 2 bytes [74, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtClose 000000007778f9c0 5 bytes JMP 0000000168675f49
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtQueryObject 000000007778f9d8 5 bytes JMP 0000000168676411
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtOpenKey 000000007778fa08 5 bytes JMP 000000016867016d
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateValueKey 000000007778fa20 5 bytes JMP 000000016866fbca
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtQueryKey 000000007778fa70 5 bytes JMP 000000016866fa44
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 000000007778fa88 2 bytes JMP 000000016866fb52
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey + 3 000000007778fa8b 2 bytes [EE, F0]
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtCreateKey 000000007778fb20 5 bytes JMP 0000000168670424
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 000000007778fc18 5 bytes JMP 0000000168674369
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtEnumerateKey 000000007778fd2c 5 bytes JMP 000000016866f9cc
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 000000007778fd44 5 bytes JMP 0000000168674959
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile 000000007778fd78 5 bytes JMP 00000001686739de
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtDuplicateObject 000000007778fe24 5 bytes JMP 0000000168675fc4
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtQueryAttributesFile 000000007778fe3c 5 bytes JMP 0000000168674adb
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000077790094 5 bytes JMP 0000000168674791
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 00000000777901a4 5 bytes JMP 000000016866fc42
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtDeleteFile 00000000777909c4 5 bytes JMP 0000000168674584
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtDeleteKey 00000000777909dc 5 bytes JMP 000000016866cc5b
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000077790a24 5 bytes JMP 000000016866cd29
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtFlushKey 0000000077790b60 5 bytes JMP 000000016866ccc2
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeKey 0000000077790f50 5 bytes JMP 000000016866fcba
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtNotifyChangeMultipleKeys 0000000077790f68 5 bytes JMP 000000016866ff45
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtOpenKeyEx 0000000077790ff8 5 bytes JMP 00000001686701fd
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtQueryFullAttributesFile 000000007779131c 5 bytes JMP 0000000168674b6b
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtQueryMultipleValueKey 000000007779145c 5 bytes JMP 000000016866fec9
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtQuerySecurityObject 0000000077791508 5 bytes JMP 0000000168676389
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtRenameKey 00000000777916f8 1 byte JMP 000000016866d138
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtRenameKey + 2 00000000777916fa 3 bytes {JMP 0xfffffffff0edba40}
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationKey 0000000077791a38 5 bytes JMP 000000016866facc
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\ntdll.dll!NtSetSecurityObject 0000000077791b7c 5 bytes JMP 000000016867616c
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\kernel32.dll!CreateProcessW 000000007557103d 5 bytes JMP 00000001686493a9
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\kernel32.dll!CreateProcessA 0000000075571072 5 bytes JMP 00000001686494e7
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\kernel32.dll!CreateProcessAsUserW 000000007559c9b5 5 bytes JMP 000000016864971d
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\kernel32.dll!SetDllDirectoryW 00000000755f00c3 5 bytes JMP 0000000168649efe
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\kernel32.dll!SetDllDirectoryA 00000000755f016b 5 bytes JMP 000000016864a231
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\kernel32.dll!WinExec 00000000755f2c91 5 bytes JMP 0000000168649aa0
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\kernel32.dll!AllocConsole 0000000075616b3e 5 bytes JMP 0000000168677431
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\kernel32.dll!AttachConsole 0000000075616c02 5 bytes JMP 0000000168677443
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076402aa4 5 bytes JMP 000000016864a43c
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076cd8a29 5 bytes JMP 0000000168677419
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\USER32.dll!CreateWindowExA 0000000076cdd22e 5 bytes JMP 0000000168677401
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\GDI32.dll!AddFontResourceW 0000000076e5d2b2 5 bytes JMP 0000000168657617
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\GDI32.dll!AddFontResourceA 0000000076e5d7bb 5 bytes JMP 00000001686575fb
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ADVAPI32.dll!EnumDependentServicesW 0000000075381e3a 7 bytes JMP 000000016865a3b9
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ADVAPI32.dll!EnumServicesStatusExW 000000007538b466 7 bytes JMP 000000016865b2da
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ADVAPI32.dll!GetServiceKeyNameW 00000000753a78ff 7 bytes JMP 000000016865aa60
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ADVAPI32.dll!GetServiceDisplayNameW 00000000753a79bb 7 bytes JMP 000000016865ac11
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ADVAPI32.dll!EnumServicesStatusExA 00000000753aa3e2 7 bytes JMP 000000016865b3a0
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ADVAPI32.dll!CreateProcessAsUserA 00000000753c2538 5 bytes JMP 000000016864985f
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ADVAPI32.dll!GetServiceKeyNameA 00000000753e1b94 7 bytes JMP 000000016865ab18
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ADVAPI32.dll!GetServiceDisplayNameA 00000000753e1c31 7 bytes JMP 000000016865acc9
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ADVAPI32.dll!EnumServicesStatusA 00000000753e2021 7 bytes JMP 000000016865b21c
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ADVAPI32.dll!EnumDependentServicesA 00000000753e2104 7 bytes JMP 000000016865a470
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ADVAPI32.dll!EnumServicesStatusW 00000000753e2221 5 bytes JMP 000000016865b15e
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!ControlService 0000000075054d5c 7 bytes JMP 000000016865a1fe
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!CloseServiceHandle 0000000075054dc3 7 bytes JMP 000000016865a527
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!QueryServiceStatus 0000000075054e4b 7 bytes JMP 000000016865a28a
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!QueryServiceStatusEx 0000000075054eaf 7 bytes JMP 000000016865a31d
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!StartServiceW 0000000075054f35 7 bytes JMP 000000016865a079
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!StartServiceA 000000007505508d 7 bytes JMP 000000016865a10f
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!QueryServiceObjectSecurity 00000000750550f4 7 bytes JMP 000000016865b02c
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075055181 7 bytes JMP 000000016865b0c8
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075055254 7 bytes JMP 000000016865a728
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 00000000750553d5 7 bytes JMP 000000016865a643
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 00000000750554c2 7 bytes JMP 000000016865a9ca
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 00000000750555e2 7 bytes JMP 000000016865a934
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 000000007505567c 7 bytes JMP 0000000168659e5b
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 000000007505589f 7 bytes JMP 0000000168659d85
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075055a22 7 bytes JMP 000000016865a5b5
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigA 0000000075055a83 7 bytes JMP 000000016865ae5b
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfigW 0000000075055b29 7 bytes JMP 000000016865adc2
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!ControlServiceExA 0000000075055ca0 7 bytes JMP 0000000168659535
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!ControlServiceExW 0000000075055d8c 7 bytes JMP 00000001686594bc
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!OpenSCManagerW 00000000750563ad 7 bytes JMP 0000000168659a83
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!OpenSCManagerA 00000000750564f0 7 bytes JMP 0000000168659b0f
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfig2A 0000000075056633 7 bytes JMP 000000016865af90
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!QueryServiceConfig2W 000000007505680c 7 bytes JMP 000000016865aef4
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!OpenServiceW 000000007505714b 7 bytes JMP 0000000168659bf8
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\SysWOW64\sechost.dll!OpenServiceA 0000000075057245 7 bytes JMP 0000000168659c84
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ole32.dll!CoRegisterPSClsid 000000007522c56e 5 bytes JMP 00000001686611c4
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ole32.dll!CoResumeClassObjects + 7 000000007522ea09 7 bytes JMP 0000000168661795
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ole32.dll!OleRun 00000000752307de 5 bytes JMP 0000000168661650
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ole32.dll!CoRegisterClassObject 00000000752321e1 5 bytes JMP 00000001686622c5
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ole32.dll!OleUninitialize 000000007523eba1 6 bytes JMP 000000016866156f
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ole32.dll!OleInitialize 000000007523efd7 5 bytes JMP 00000001686614ff
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ole32.dll!CoGetPSClsid 00000000752426b9 5 bytes JMP 000000016866133c
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ole32.dll!CoGetClassObject 00000000752554ad 5 bytes JMP 0000000168662853
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ole32.dll!CoInitializeEx 00000000752609ad 5 bytes JMP 00000001686613af
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ole32.dll!CoUninitialize 00000000752686d3 5 bytes JMP 0000000168661431
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075269d0b 5 bytes JMP 0000000168663b21
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ole32.dll!CoCreateInstanceEx 0000000075269d4e 5 bytes JMP 0000000168661c5c
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ole32.dll!CoSuspendClassObjects + 7 000000007528bb09 7 bytes JMP 00000001686616c0
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ole32.dll!CoRevokeClassObject 00000000752aeacf 5 bytes JMP 0000000168660c21
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ole32.dll!CoGetInstanceFromFile 00000000752e340b 5 bytes JMP 0000000168662d13
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\ole32.dll!OleRegEnumFormatEtc 000000007532cfd9 5 bytes JMP 00000001686615da
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\oleaut32.dll!RegisterActiveObject 000000007630279e 5 bytes JMP 0000000168660eb4
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\oleaut32.dll!RevokeActiveObject 0000000076303294 5 bytes JMP 0000000168660fd5
.text C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe[5028] C:\Windows\syswow64\oleaut32.dll!GetActiveObject 0000000076318f40 5 bytes JMP 0000000168661048
---- Threads - GMER 2.1 ----
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [4200:6344] 0000000075057587
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [4200:6436] 0000000068790cb3
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [4200:5900] 00000000777c2e25
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [4200:5744] 00000000777c3e45
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [4200:4788] 00000000777c3e45
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [4200:6060] 00000000777c3e45
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\642737998f52
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\642737998f52@fcc7344fbd4e 0xF6 0xF3 0x5E 0xF2 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\64273799a960
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\642737998f52 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\642737998f52@fcc7344fbd4e 0xF6 0xF3 0x5E 0xF2 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\64273799a960 (not active ControlSet)
---- EOF - GMER 2.1 ----
Danke für Eure Hilfe! Hallöchen, da wir heute in den Urlaub fahren, kann ich hier leider erst in 2 Wochen weiter machen. Sorry! Ich hoffe einer/eine von Euch hat soviel Geduld. LG bis dahin. |
| Themen zu Nach Hotelbesuch braucht PC ewig bis Internet und weitere Programme starten |
| adobe, adobe reader xi, avg, avg secure search, bingbar, error, explorer, firefox, flash player, format, home, install.exe, internet, kaspersky, leistungsprobleme, leistungsverlust, microsoft office starter 2010, mozilla, netzwerk, ntdll.dll, ntopenkeyex, programme, realtek, registry, rundll, scan, schwedisch, secure search, security, server, starten, svchost.exe, vtoolbarupdater, windows, windows xp, wlan |
Baum-Darstellung