| |
| |||||||
Log-Analyse und Auswertung: Computer langsam und stürtzt häufig abWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
27.02.2011, 16:17
| #1 |
 |  Computer langsam und stürtzt häufig ab Hallo Vor einiger Zeit habe ich im Internet einen Stream gestartet, woraufhin der komplette Bildschirm rot war. Ich hab sofort den Computer vom Netz genommen und anschliessend neu gestartet. Seither funktioniert alles, jedoch sind der Computer und auch Firefox sehr langsam und stürtzen häufig ab. Zwischendurch installiert sich auch ein fremdes Laufwerk (der Name vom Laufwerk enthält Sonderzeichen wie *$?!). Malwarebytes-Anti-Maleware und OTL habe ich bereits durchgeführt. Log-Files sind beigefügt. Soll ich alle gefundenen Elemente löschen? Das System hat nur 2 der Files von selbst ausgewählt, weshalb ich die anderen noch nicht gelöscht habe. Danke + Gruss nati |
|
27.02.2011, 21:51
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Computer langsam und stürtzt häufig abZitat:
__________________ |
|
28.02.2011, 08:20
| #3 |
| | Computer langsam und stürtzt häufig ab Hallo Arne
__________________Habe nur zwei Funde entfernt. Die anderen wurden nicht automatisch selektiert und es hat so ausgesehen, als wären wichtige Programm-Files betroffen. Soll ich einfach alle Funde löschen? Gruss, nati |
|
28.02.2011, 12:49
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Computer langsam und stürtzt häufig ab Ja bitte alles löschen.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
28.02.2011, 20:32
| #5 |
| | Computer langsam und stürtzt häufig ab Schönen Abend Hier nochmal meine Files. Gruss nati |
|
28.02.2011, 21:05
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Computer langsam und stürtzt häufig ab Bitte ZoneAlarm deinstallieren und die Windows-Firewall aktivieren. ZA ist Quatsch mit Sauce. Sag Bescheid wenn es weg ist, dann gehts weiter.
__________________ --> Computer langsam und stürtzt häufig ab |
|
01.03.2011, 19:08
| #7 |
| | Computer langsam und stürtzt häufig ab Guten Abend ZoneAlarm ist deinstalliert und Windows-Firewall aktiv. Gruss, nati |
|
01.03.2011, 21:57
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Computer langsam und stürtzt häufig ab Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
02.03.2011, 20:14
| #9 |
| | Computer langsam und stürtzt häufig ab Hallo Habe es nach Anleitung durchgeführt. Beim Neustart ist der Computer aber hängen geblieben. Konnte ihn dann nochmal neustarten und jetzt macht er komische Geräusche - lautes Knacken und Zischen. File über C:\cofi.exe\ComboFix.txt geöffnet: ComboFix 11-03-02.01 - *** 02.03.2011 18:49:31.1.2 - x86 Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.49.1031.18.3571.2343 [GMT 1:00] ausgeführt von:: C:\Users\***\Desktop\cofi.exe.exe AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7} SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . C:\ProgramData\hpe9E32.dll G:\Autorun.inf . ((((((((((((((((((((((( Dateien erstellt von 2011-02-02 bis 2011-03-02 )))))))))))))))))))))))))))))) . Gruss, nati Geändert von nati_123 (02.03.2011 um 20:29 Uhr) |
|
02.03.2011, 20:46
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Computer langsam und stürtzt häufig ab Mehr steht im Logfile nicht?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
02.03.2011, 20:51
| #11 |
| | Computer langsam und stürtzt häufig ab .. ich find leider nicht mehr .. das file ist beigefügt ich wurde während der ausführung auch nicht nach updates oder der wiederherstellungskonsole gefragt. soll ich es nochmals durchführen? hatte die externen festplatten angeschlossen - vielleicht haben die gestört? gruss, nati Geändert von nati_123 (02.03.2011 um 21:04 Uhr) |
|
02.03.2011, 21:06
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Computer langsam und stürtzt häufig ab Führe cofi dann bitte nochmal aus. Bitte per Rechtsklick => als Admin ausführen!!!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
02.03.2011, 21:26
| #13 |
| | Computer langsam und stürtzt häufig ab besser: Combofix Logfile: Code:
ATTFilter ComboFix 11-03-02.01 - *** 02.03.2011 21:18:15.2.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.49.1031.18.3571.2521 [GMT 1:00]
ausgeführt von:: c:\users\***\Desktop\cofi.exe.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Vorheriger Suchlauf -------
.
c:\programdata\hpe9E32.dll
G:\Autorun.inf
.
((((((((((((((((((((((( Dateien erstellt von 2011-02-02 bis 2011-03-02 ))))))))))))))))))))))))))))))
.
2011-03-02 20:23 . 2011-03-02 20:23 -------- d-----w- c:\users\***\AppData\Local\temp
2011-03-02 20:23 . 2011-03-02 20:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-03-02 17:35 . 2011-03-02 17:35 -------- d-----w- c:\program files\CCleaner
2011-03-01 18:05 . 2011-03-01 18:05 -------- d-----w- c:\windows\Internet Logs
2011-03-01 17:48 . 2011-02-11 06:54 5943120 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8BAB6A8D-734F-4EDB-9C9B-F3CF1EC34BAF}\mpengine.dll
2011-02-27 06:22 . 2011-02-27 06:22 -------- d-----w- c:\windows\CheckSur
2011-02-26 09:22 . 2011-02-26 09:22 -------- d-----w- c:\users\***\AppData\Roaming\Malwarebytes
2011-02-26 09:22 . 2011-02-26 09:22 -------- d-----w- c:\programdata\Malwarebytes
2011-02-26 09:22 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-26 09:22 . 2011-02-26 09:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-02-26 09:22 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-02-25 19:46 . 2011-02-25 19:46 -------- d-----w- c:\users\***\AppData\Roaming\dvdcss
2011-02-24 20:31 . 2009-10-09 21:56 2048 ----a-w- c:\windows\system32\winrsmgr.dll
2011-02-24 20:31 . 2009-10-09 21:56 12800 ----a-w- c:\windows\system32\wsmprovhost.exe
2011-02-24 20:31 . 2009-10-09 21:56 20480 ----a-w- c:\windows\system32\winrshost.exe
2011-02-24 20:31 . 2009-10-09 21:56 40448 ----a-w- c:\windows\system32\winrs.exe
2011-02-24 20:31 . 2009-10-09 21:56 10240 ----a-w- c:\windows\system32\wsmplpxy.dll
2011-02-24 20:31 . 2009-10-09 21:56 10240 ----a-w- c:\windows\system32\winrssrv.dll
2011-02-24 20:31 . 2009-10-09 21:56 41472 ----a-w- c:\windows\system32\pwrshplugin.dll
2011-02-24 20:31 . 2009-10-09 21:55 79872 ----a-w- c:\windows\system32\wecutil.exe
2011-02-24 20:31 . 2009-10-09 21:55 54272 ----a-w- c:\windows\system32\WsmRes.dll
2011-02-24 20:31 . 2009-10-09 21:55 146944 ----a-w- c:\windows\system32\wecsvc.dll
2011-02-24 20:31 . 2009-10-09 21:55 81408 ----a-w- c:\windows\system32\wevtfwd.dll
2011-02-24 20:31 . 2009-10-09 21:55 56320 ----a-w- c:\windows\system32\wecapi.dll
2011-02-24 20:30 . 2009-08-01 06:27 201184 ----a-w- c:\windows\system32\winrm.vbs
2011-02-24 20:30 . 2009-10-09 21:56 145408 ----a-w- c:\windows\system32\WsmAuto.dll
2011-02-24 20:30 . 2009-10-09 21:56 1181696 ----a-w- c:\windows\system32\WsmSvc.dll
2011-02-24 20:30 . 2009-10-09 21:56 214016 ----a-w- c:\windows\system32\WsmWmiPl.dll
2011-02-24 20:30 . 2009-10-09 21:56 241152 ----a-w- c:\windows\system32\winrscmd.dll
2011-02-24 20:30 . 2009-10-09 21:56 246272 ----a-w- c:\windows\system32\WSManHTTPConfig.exe
2011-02-24 20:30 . 2009-10-09 21:55 252416 ----a-w- c:\windows\system32\WSManMigrationPlugin.dll
2011-02-16 16:08 . 2011-02-28 19:11 -------- d-----w- c:\program files\Application Updater
2011-02-16 16:08 . 2011-02-16 16:08 -------- d-----w- c:\program files\Common Files\Spigot
2011-02-13 18:41 . 2011-02-13 18:41 -------- d-----w- c:\program files\iPod
2011-02-13 18:41 . 2011-02-13 18:42 -------- d-----w- c:\program files\iTunes
2011-02-13 18:39 . 2011-02-13 18:39 -------- d-----w- c:\program files\QuickTime
2011-02-13 18:36 . 2011-02-13 18:36 -------- d-----w- c:\program files\Bonjour
2011-02-09 18:04 . 2010-12-31 13:57 2039808 ----a-w- c:\windows\system32\win32k.sys
2011-02-09 18:04 . 2010-10-15 14:08 3602320 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-02-09 18:04 . 2010-10-15 13:48 1205080 ----a-w- c:\windows\system32\ntdll.dll
2011-02-09 18:04 . 2010-10-15 14:08 3550096 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-02-09 18:04 . 2011-01-06 10:51 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-26 19:28 . 2009-05-20 20:19 0 ----a-w- c:\users\***\AppData\Local\WavXMapDrive.bat
2011-02-02 16:11 . 2009-10-07 19:21 222080 ------w- c:\windows\system32\MpSigStub.exe
2010-12-28 15:55 . 2011-01-11 18:48 413696 ----a-w- c:\windows\system32\odbc32.dll
2010-12-24 22:31 . 2009-11-01 08:30 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-12-14 17:51 . 2010-12-14 17:51 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2010-12-14 17:51 . 2010-12-14 17:51 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
2010-12-14 14:49 . 2011-01-11 18:48 1169408 ----a-w- c:\windows\system32\sdclt.exe
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-09-28 20:44 1400712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\EnabledUnlockedFDEIconOverlay]
@="{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}"
[HKEY_CLASSES_ROOT\CLSID\{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A}]
2009-01-14 08:24 40960 ----a-w- c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]
@="{CF08DA3E-C97D-4891-A66B-E39B28DD270F}"
[HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]
2009-01-14 08:24 40960 ----a-w- c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-02-23 200704]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-04 13543968]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-07-04 92704]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2008-07-04 96800]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-12-04 186904]
"picon"="c:\program files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe" [2008-06-02 367128]
"DellControlPoint"="c:\program files\Dell\Dell ControlPoint\Dell.ControlPoint.exe" [2009-01-19 667648]
"USCService"="c:\program files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe" [2009-01-16 15360]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-09-19 827392]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-07 281768]
"NetFxUpdate_v1.1.4322"="c:\windows\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe" [2004-08-10 106496]
"SecureUpgrade"="c:\program files\Wave Systems Corp\SecureUpgrade.exe" [2009-01-16 656696]
"EmbassySecurityCheck"="c:\program files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe" [2009-01-16 95544]
"ChangeTPMAuth"="c:\program files\Wave Systems Corp\Common\ChangeTPMAuth.exe" [2008-12-19 184320]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"InfoCockpit"="c:\program files\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE" [2007-07-30 176128]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-6-5 752168]
Dell ControlPoint System Manager.lnk - c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe [2009-2-6 1084192]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-09-20 22:07 932288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 03:47 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellConnectionManager]
2009-03-01 16:09 1810432 ----a-w- c:\program files\Dell\Dell ControlPoint\Connection Manager\Dell.UCM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-01-25 14:08 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2010-12-20 17:08 963976 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVDDXSrv]
2009-02-04 19:26 128232 ------w- c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PicPick Start]
2010-07-30 05:18 4972032 ----a-w- c:\program files\PicPick\picpick.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 16:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SearchSettings]
2011-01-28 16:36 526336 ----a-w- c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
2009-09-24 12:41 434176 ----a-w- c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 15:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 09:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WavXMgr]
2008-12-22 10:15 134144 ----a-w- c:\program files\Wave Systems Corp\Services Manager\DocMgr\bin\WavXDocMgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"FirewallOverride"=dword:00000001
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 dtpd;ShrewSoft DNS Proxy Daemon;c:\program files\ShrewSoft\VPN Client\dtpd.exe [2009-11-15 49152]
R2 iked;ShrewSoft IKE Daemon;c:\program files\ShrewSoft\VPN Client\iked.exe [2009-11-15 716800]
R2 ipsecd;ShrewSoft IPSEC Daemon;c:\program files\ShrewSoft\VPN Client\ipsecd.exe [2009-11-15 536576]
R3 AsfAlrt;AsfAlrt Service;c:\windows\system32\Drivers\AsfAlrt.sys [2007-04-19 42832]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2008-06-16 29736]
R3 MTOnlPktAlyX;MTOnlPktAlyX NDIS Protocol Driver;c:\progra~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS [2006-10-09 17536]
R3 NvtSp50;NvtSp50 NDIS Protocol Driver;c:\windows\system32\Drivers\NvtSp50.sys [x]
R3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\DRIVERS\s1018bus.sys [2008-11-04 86696]
R3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1018mdfl.sys [2008-11-04 15016]
R3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1018mdm.sys [2008-11-04 114472]
R3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1018mgmt.sys [2008-11-04 108200]
R3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1018nd5.sys [2008-11-04 26024]
R3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1018obex.sys [2008-11-04 104616]
R3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1018unic.sys [2008-11-04 109736]
R3 vnet;Shrew Soft Virtual Adapter;c:\windows\system32\DRIVERS\virtualnet.sys [2009-11-19 9728]
R3 VST_DPV;VST_DPV;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2008-01-21 987648]
R3 VSTHWBS2;VSTHWBS2;c:\windows\system32\DRIVERS\VSTBS23.SYS [2008-01-21 251904]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-11-12 135664]
R4 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
S1 vflt;Shrew Soft Lightweight Filter;c:\windows\system32\DRIVERS\vfilter.sys [2009-11-19 17408]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_38163857\aestsrv.exe [2009-03-17 81920]
S2 alssvc;Ambient Light Sensor;c:\program files\Dell\Ambient Light Sensor\AlsSvc.exe [2008-06-03 382232]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-11-07 135336]
S2 ASFAgent;ASF Agent;c:\program files\Intel\ASF Agent\ASFAgent.exe [2007-04-19 133968]
S2 buttonsvc32;Dell ControlPoint Button Service;c:\program files\Dell\Dell ControlPoint\DCPButtonSvc.exe [2008-12-29 320800]
S2 Credential Vault Host Control Service;Credential Vault Host Control Service;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe [2009-01-22 808296]
S2 Credential Vault Host Storage;Credential Vault Host Storage;c:\program files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe [2009-01-22 20840]
S2 dcpsysmgrsvc;Dell ControlPoint System Manager;c:\program files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe [2009-02-06 443168]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 SMManager;Smith Micro Connection Manager Service;c:\program files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe [2009-03-01 77824]
S2 UNS;Intel(R) Active Management Technology User Notification Service;c:\program files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2008-06-02 2058776]
S3 cvusbdrv;Broadcom USH CV;c:\windows\system32\Drivers\cvusbdrv.sys [2009-01-22 32808]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y6032.sys [2009-02-23 224384]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-09-25 3666432]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2008-01-09 27632]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ
getPlusHelper REG_MULTI_SZ getPlusHelper
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
2011-03-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-12 21:37]
2011-03-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-12 21:37]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.hispeed.ch
uInternet Settings,ProxyOverride = *.local
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Free YouTube Download - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: {7D94D6B2-1B49-4470-9687-712B6F74D21C} = 192.168.1.10,172.16.2.30
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\ibcviqyo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - SPIEGEL ONLINE - Nachrichten
FF - prefs.js: keyword.URL - hxxp://ch.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=302398&p=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Skype extension for Firefox: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Move Media Player: moveplayer@movenetworks.com - %profile%\extensions\moveplayer@movenetworks.com
FF - Ext: Forecastfox Weather: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} - %profile%\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Adobe DLM (powered by getPlus(R)): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Ask Toolbar: toolbar@ask.com - %profile%\extensions\toolbar@ask.com
FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
HKLM-Run-SysTrayApp - %ProgramFiles%\IDT\WDM\sttray.exe
MSConfigStartUp-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2011-03-02 21:23
Windows 6.0.6002 Service Pack 2 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
- - - - - - - > 'Explorer.exe'(5452)
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll
c:\windows\system32\btmmhook.dll
.
Zeit der Fertigstellung: 2011-03-02 21:24:19
ComboFix-quarantined-files.txt 2011-03-02 20:24
Vor Suchlauf: 14 Verzeichnis(se), 25.682.538.496 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 25.610.440.704 Bytes frei
- - End Of File - - 57D9047BEC19EEC2CA1852AB4514C419
|
|
02.03.2011, 22:10
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Computer langsam und stürtzt häufig ab Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
03.03.2011, 20:50
| #15 |
| | Computer langsam und stürtzt häufig ab Guten Abend hier sind meine Log-Files. Bei OSAM habe ich noch keine Einträge deaktiviert. GMER Logfile: Code:
ATTFilter GMER 1.0.15.15530 - GMER - Rootkit Detector and Remover
Rootkit scan 2011-03-03 20:25:00
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD16 rev.11.0
Running: 2v7il1rn.exe; Driver: C:\Users\***\AppData\Local\Temp\agryqpog.sys
---- Kernel code sections - GMER 1.0.15 ----
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8FC04340, 0x3EC0F7, 0xE8000020]
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74197817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [741EA86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7419BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7418F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [741975E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [7418E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [741C8395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [7419DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [7418FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [7418FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [741871CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7421CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [741BC8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [7418D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [74186853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [7418687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[156] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [74192AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\BthPort\Parameters\Keys\00225f4f5a54
Reg HKLM\SYSTEM\CurrentControlSet\Services\BthPort\Parameters\Keys\00225f4f5a54@001cd682e393 0xE1 0xBB 0xB6 0x77 ...
Reg HKLM\SYSTEM\ControlSet002\Services\BthPort\Parameters\Keys\00225f4f5a54 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\BthPort\Parameters\Keys\00225f4f5a54@001cd682e393 0xE1 0xBB 0xB6 0x77 ...
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{1486bfc0-f586-484e-a0bb-17c94da3ea89}@Dhcpv6Iaid 201335146
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{1486bfc0-f586-484e-a0bb-17c94da3ea89}@Dhcpv6State 1
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{23921bc8-2fc0-4849-9192-b085c54140ec}@Dhcpv6Iaid 251663218
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{23921bc8-2fc0-4849-9192-b085c54140ec}@Dhcpv6State 0
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{39e77534-ef2e-4d2d-a51d-12064a5b2d10}@Dhcpv6Iaid 318767104
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{39e77534-ef2e-4d2d-a51d-12064a5b2d10}@Dhcpv6State 0
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{58c9af46-081f-47ec-9255-df41cc92bdfc}@Dhcpv6Iaid 251822135
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{58c9af46-081f-47ec-9255-df41cc92bdfc}@Dhcpv6State 0
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{6225abdb-e3da-4904-bfa9-7b7d7ad5ec34}@Dhcpv6Iaid 570425344
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{6225abdb-e3da-4904-bfa9-7b7d7ad5ec34}@Dhcpv6State 0
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{7a0fc165-a22e-4e2a-b2ca-84c3d0b61118}@Dhcpv6Iaid 369107551
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{7a0fc165-a22e-4e2a-b2ca-84c3d0b61118}@Dhcpv6State 0
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{7d94d6b2-1b49-4470-9687-712b6f74d21c}@Dhcpv6Iaid 279620266
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{7d94d6b2-1b49-4470-9687-712b6f74d21c}@Dhcpv6State 1
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{8063b8bf-e98a-4896-b59a-0ac70752649b}@Dhcpv6Iaid 117445666
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{8063b8bf-e98a-4896-b59a-0ac70752649b}@Dhcpv6State 0
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{8f2ce902-abc6-4b39-8fbe-191ec5e9b934}@Dhcpv6Iaid 201331746
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{8f2ce902-abc6-4b39-8fbe-191ec5e9b934}@Dhcpv6State 0
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{ba8c3398-852a-42ab-a470-bb949bf3f067}@Dhcpv6Iaid 268566612
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{ba8c3398-852a-42ab-a470-bb949bf3f067}@Dhcpv6State 0
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{ba9e677f-0ef8-4bb2-a3e5-3ba5c63d1e87}@Dhcpv6Iaid 100668450
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{ba9e677f-0ef8-4bb2-a3e5-3ba5c63d1e87}@Dhcpv6State 0
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{c68b757b-ee29-40b4-90d2-2e711ceb81b7}@Dhcpv6Iaid 251667688
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{c68b757b-ee29-40b4-90d2-2e711ceb81b7}@Dhcpv6State 0
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{fbd5060f-20a6-4dda-8c6e-67a10860fd75}@Dhcpv6Iaid 234886178
Reg HKLM\SYSTEM\ControlSet002\Services\Tcpip6\Parameters\Interfaces\{fbd5060f-20a6-4dda-8c6e-67a10860fd75}@Dhcpv6State 0
Reg HKLM\SYSTEM\ControlSet003\Services\BthPort\Parameters\Keys\00225f4f5a54 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\BthPort\Parameters\Keys\00225f4f5a54@001cd682e393 0xE1 0xBB 0xB6 0x77 ...
---- EOF - GMER 1.0.15 ----
OSAM Logfile: Code:
ATTFilter Report of OSAM: Autorun Manager v5.0.11926.0 Online Solutions. Complex Protection for Information Systems Saved at 20:43:42 on 03.03.2011 OS: Windows Vista Home Basic Edition Service Pack 2 (Build 6002), 32-bit Default Browser: Mozilla Corporation Firefox 3.6.14 Scanner Settings [x] Rootkits detection (hidden registry) [x] Rootkits detection (hidden files) [x] Retrieve files information [x] Check Microsoft signatures Filters [ ] Trusted entries [ ] Empty entries [x] Hidden registry entries (rootkit activity) [x] Exclusively opened files [x] Not found files [x] Files without detailed information [x] Existing files [ ] Non-startable services [ ] Non-startable drivers [x] Active entries [x] Disabled entries [Common] -----( %SystemRoot%\Tasks )----- "GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe "GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe [Control Panel Objects] -----( %SystemRoot%\system32 )----- "AlertApp.cpl" - "Intel Corporation" - C:\Windows\system32\AlertApp.cpl "DellControlPoint.cpl" - ? - C:\Windows\system32\DellControlPoint.cpl (File found, but it contains no detailed information) "iproset.cpl" - "Intel(R) Corporation" - C:\Windows\system32\iproset.cpl "ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )----- "CinePlayer DVD Decoder Options" - "Sonic Solutions" - C:\Program Files\Sonic\CinePlayer Decoder Pack\cmdvdpak.cpl "mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL "NokiaConnectionManager" - "Nokia" - C:\PROGRA~1\Nokia\NOKIAP~1\CONNEC~1.CPL "PROSet Tools" - "Intel(R) Corporation" - C:\Windows\System32\iPROSet.cpl "QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl [Drivers] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "AsfAlrt Service" (AsfAlrt) - "Intel Corporation" - C:\Windows\system32\Drivers\AsfAlrt.sys "avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys "avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys "avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys "BVRPMPR5 NDIS Protocol Driver" (BVRPMPR5) - "Avanquest Software" - C:\Windows\system32\drivers\BVRPMPR5.SYS "catchme" (catchme) - ? - C:\Users\***\AppData\Local\Temp\catchme.sys (File not found) "IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys (File not found) "IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys (File not found) "IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys (File not found) "MTOnlPktAlyX NDIS Protocol Driver" (MTOnlPktAlyX) - "Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH" - C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS "Nal Service " (NAL) - "Intel Corporation " - C:\Windows\system32\Drivers\iqvw32.sys "NvtSp50 NDIS Protocol Driver" (NvtSp50) - ? - C:\Windows\System32\Drivers\NvtSp50.sys (File not found) "PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys "ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys "WavxDMgr" (WavxDMgr) - "Wave Systems Corp." - C:\Windows\System32\DRIVERS\WavxDMgr.sys [Explorer] -----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )----- {F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll -----( HKLM\Software\Classes\Protocols\Filter )----- {807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL -----( HKLM\Software\Classes\Protocols\Handler )----- {314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL {828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL {828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL {03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )----- {AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? - (File not found | COM-object registry key not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )----- {911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? - (File not found | COM-object registry key not found) {1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? - (File not found | COM-object registry key not found) {0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll {0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? - (File not found | COM-object registry key not found) {2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? - (File not found | COM-object registry key not found) {B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll {42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MSOHEVI.DLL {993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL {C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll {7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll {416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - C:\Program Files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll {0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL {C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? - (File not found | COM-object registry key not found) {45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll {2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll {00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe {00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll {da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? - (File not found | COM-object registry key not found) {B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll {06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe [Internet Explorer] -----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )----- <binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll <binary data> "Ask Toolbar" - "Ask" - C:\Program Files\Ask.com\GenericAskToolbar.dll <binary data> "ITBar7Layout" - ? - (File not found | COM-object registry key not found) <binary data> "{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107}" - ? - (File not found | COM-object registry key not found) -----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )----- {8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )----- "@btrez.dll,-4015" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm {53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll {5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll {FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL -----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )----- <binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll <binary data> "Ask Toolbar" - "Ask" - C:\Program Files\Ask.com\GenericAskToolbar.dll -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )----- {18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll {D4027C7F-154A-4066-A1AD-4243D8127440} "Ask Toolbar" - "Ask" - C:\Program Files\Ask.com\GenericAskToolbar.dll {DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll {53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll {5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? - (File not found | COM-object registry key not found) [Logon] -----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )----- "desktop.ini" - ? - C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )----- "Bluetooth.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Shortcut exists | File exists) "Dell ControlPoint System Manager.lnk" - "Dell Inc." - C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe (Shortcut exists | File exists) "desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini -----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )----- "ISUSPM" - "Macrovision Corporation" - "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler -----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )----- "StartupPrograms" - ? - rdpclip (File not found) -----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )----- "avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min "ChangeTPMAuth" - "Wave Systems Corp." - C:\Program Files\Wave Systems Corp\Common\ChangeTPMAuth.exe /T:NTRU12 "DellControlPoint" - "Dell Inc." - "C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe" "EmbassySecurityCheck" - "Wave Systems Corp." - "C:\Program Files\Wave Systems Corp\EMBASSY Security Setup\EMBASSYSecurityCheck.exe" "IAAnotif" - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe "Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript "NetFxUpdate_v1.1.4322" - "Microsoft" - "C:\Windows\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe" 1 v1.1.4322 GAC + NI NID "picon" - "Intel Corporation" - "C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe" -startup "SecureUpgrade" - "Wave Systems Corp." - "C:\Program Files\Wave Systems Corp\SecureUpgrade.exe" "USCService" - "Broadcom Corporation" - C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe [Network Providers] -----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )----- "TDM Network Provider" - "Wave Systems Corp." - C:\Windows\System32\TdmNetworkProvider.dll [Print Monitors] -----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )----- "PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll (File found, but it contains no detailed information) [Services] -----( HKLM\SYSTEM\CurrentControlSet\Services )----- "@%SystemRoot%\system32\wecsvc.dll,-200" (Wecsvc) - "Microsoft Corporation" - C:\Windows\system32\wecsvc.dll "@%Systemroot%\system32\wsmsvc.dll,-101" (WinRM) - "Microsoft Corporation" - C:\Windows\system32\WsmSvc.dll "@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe "Ambient Light Sensor" (alssvc) - "Dell Inc." - C:\Program Files\Dell\Ambient Light Sensor\AlsSvc.exe "ASF Agent" (ASFAgent) - "Intel Corporation" - C:\Program Files\Intel\ASF Agent\ASFAgent.exe "Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe "Avira AntiVir Scheduler" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe "Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe "Credential Vault Host Control Service" (Credential Vault Host Control Service) - "Broadcom Corporation" - C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe "Credential Vault Host Storage" (Credential Vault Host Storage) - "Broadcom Corporation" - C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe "Dell ControlPoint Button Service" (buttonsvc32) - "Dell Inc." - C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe "Dell ControlPoint System Manager" (dcpsysmgrsvc) - "Dell Inc." - C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe "Intel(R) Active Management Technology Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files\Intel\AMT\LMS.exe "Intel(R) Active Management Technology User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe "Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe "Intel® PROSet/Wireless Event Log" (EvtEng) - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\EvtEng.exe "Intel® PROSet/Wireless Registry Service" (RegSrvc) - "Intel(R) Corporation" - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe "iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe "Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe "Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE "NTRU TSS v1.2.1.29 TCS" (tcsd_win32.exe) - ? - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe (File found, but it contains no detailed information) "Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE "SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe "SeaPort" (SeaPort) - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe "SecureStorageService" (SecureStorageService) - "Wave Systems Corp." - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe "ServiceLayer" (ServiceLayer) - "Nokia." - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe "ShrewSoft DNS Proxy Daemon" (dtpd) - ? - C:\Program Files\ShrewSoft\VPN Client\dtpd.exe (File found, but it contains no detailed information) "ShrewSoft IKE Daemon" (iked) - ? - C:\Program Files\ShrewSoft\VPN Client\iked.exe (File found, but it contains no detailed information) "ShrewSoft IPSEC Daemon" (ipsecd) - ? - C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe (File found, but it contains no detailed information) "Smith Micro Connection Manager Service" (SMManager) - "Smith Micro Software, Inc." - C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe "stllssvr" (stllssvr) - "MicroVision Development, Inc." - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe "TdmService" (TdmService) - "Wave Systems Corp." - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe [Winsock Providers] -----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )----- "mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll ===[ Logfile end ]=========================================[ Logfile end ]=== If You have questions or want to get some help, You can visit Online Solutions :: Index MBRCheck, version 1.2.3 (c) 2010, AD Command-line: Windows Version: Windows Vista Home Basic Edition Windows Information: Service Pack 2 (build 6002), 32-bit Base Board Manufacturer: Dell Inc. BIOS Manufacturer: Dell Inc. System Manufacturer: Dell Inc. System Product Name: Latitude E6400 Logical Drives Mask: 0x0000001c Kernel Drivers (total 156): 0x82A18000 \SystemRoot\system32\ntkrnlpa.exe 0x82DD2000 \SystemRoot\system32\hal.dll 0x80407000 \SystemRoot\system32\kdcom.dll 0x8040E000 \SystemRoot\system32\mcupdate_GenuineIntel.dll 0x8047E000 \SystemRoot\system32\PSHED.dll 0x8048F000 \SystemRoot\system32\BOOTVID.dll 0x80497000 \SystemRoot\system32\CLFS.SYS 0x804D8000 \SystemRoot\system32\CI.dll 0x80601000 \SystemRoot\system32\drivers\Wdf01000.sys 0x8067D000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x8068A000 \SystemRoot\system32\drivers\acpi.sys 0x806D0000 \SystemRoot\system32\drivers\WMILIB.SYS 0x806D9000 \SystemRoot\system32\drivers\msisadrv.sys 0x806E1000 \SystemRoot\system32\drivers\pci.sys 0x80708000 \SystemRoot\System32\drivers\partmgr.sys 0x80717000 \SystemRoot\system32\DRIVERS\compbatt.sys 0x8071A000 \SystemRoot\system32\DRIVERS\BATTC.SYS 0x80724000 \SystemRoot\system32\drivers\volmgr.sys 0x80733000 \SystemRoot\System32\drivers\volmgrx.sys 0x8077D000 \SystemRoot\system32\drivers\pciide.sys 0x80784000 \SystemRoot\system32\drivers\PCIIDEX.SYS 0x80792000 \SystemRoot\system32\DRIVERS\pcmcia.sys 0x807BF000 \SystemRoot\System32\drivers\mountmgr.sys 0x8BE0C000 \SystemRoot\system32\drivers\iastor.sys 0x8BEE6000 \SystemRoot\system32\drivers\atapi.sys 0x8BEEE000 \SystemRoot\system32\drivers\ataport.SYS 0x8BF0C000 \SystemRoot\system32\drivers\fltmgr.sys 0x8BF3E000 \SystemRoot\system32\drivers\fileinfo.sys 0x8BF4E000 \SystemRoot\System32\Drivers\PxHelp20.sys 0x8BF57000 \SystemRoot\System32\Drivers\ksecdd.sys 0x8C009000 \SystemRoot\system32\drivers\ndis.sys 0x8C114000 \SystemRoot\system32\drivers\msrpc.sys 0x8C13F000 \SystemRoot\system32\drivers\NETIO.SYS 0x8C20D000 \SystemRoot\System32\drivers\tcpip.sys 0x8C2FA000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x8C40D000 \SystemRoot\System32\Drivers\Ntfs.sys 0x8C51D000 \SystemRoot\system32\drivers\volsnap.sys 0x8C556000 \SystemRoot\System32\Drivers\spldr.sys 0x8C55E000 \SystemRoot\system32\DRIVERS\PBADRV.sys 0x8C569000 \SystemRoot\System32\Drivers\mup.sys 0x8C578000 \SystemRoot\System32\drivers\ecache.sys 0x8C59F000 \SystemRoot\system32\drivers\disk.sys 0x8C5B0000 \SystemRoot\system32\drivers\CLASSPNP.SYS 0x8C5D1000 \SystemRoot\system32\drivers\crcdisk.sys 0x8C5E7000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x8C5F2000 \SystemRoot\system32\DRIVERS\tunmp.sys 0x8FC00000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys 0x90331000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x903D1000 \SystemRoot\System32\drivers\watchdog.sys 0x903DD000 \SystemRoot\system32\DRIVERS\HECI.sys 0x8C17A000 \SystemRoot\system32\DRIVERS\serial.sys 0x903E7000 \SystemRoot\system32\DRIVERS\serenum.sys 0x8C194000 \SystemRoot\system32\DRIVERS\e1y6032.sys 0x903F1000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0x805B8000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x8C3EF000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x9060F000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0x9080F000 \SystemRoot\system32\DRIVERS\NETw5v32.sys 0x90B98000 \SystemRoot\system32\DRIVERS\ohci1394.sys 0x90BA8000 \SystemRoot\system32\DRIVERS\1394BUS.SYS 0x90BB6000 \SystemRoot\system32\DRIVERS\sdbus.sys 0x90BD0000 \SystemRoot\system32\DRIVERS\rimmptsk.sys 0x90BDF000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0x9069C000 \SystemRoot\system32\DRIVERS\Apfiltr.sys 0x90BF2000 \SystemRoot\system32\DRIVERS\mouclass.sys 0x90800000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0x906C9000 \SystemRoot\system32\DRIVERS\cdrom.sys 0x906E1000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys 0x9080B000 \SystemRoot\system32\DRIVERS\CmBatt.sys 0x906E7000 \SystemRoot\system32\DRIVERS\wmiacpi.sys 0x906F0000 \SystemRoot\system32\DRIVERS\intelppm.sys 0x906FF000 \SystemRoot\system32\DRIVERS\msiscsi.sys 0x9072E000 \SystemRoot\system32\DRIVERS\storport.sys 0x9076F000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x9077A000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x90791000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x9079C000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x907BF000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x907CE000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x907E2000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x8C1CE000 \SystemRoot\system32\DRIVERS\termdd.sys 0x907F7000 \SystemRoot\system32\DRIVERS\seehcri.sys 0x90BFD000 \SystemRoot\system32\DRIVERS\swenum.sys 0x8BFC8000 \SystemRoot\system32\DRIVERS\ks.sys 0x90600000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0x8C400000 \SystemRoot\system32\DRIVERS\umbus.sys 0x90E00000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x90E35000 \SystemRoot\system32\DRIVERS\stwrt.sys 0x90E99000 \SystemRoot\system32\DRIVERS\portcls.sys 0x90EC6000 \SystemRoot\system32\DRIVERS\drmk.sys 0x90EEB000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x90EFC000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0x90F05000 \SystemRoot\System32\Drivers\Null.SYS 0x90F0C000 \SystemRoot\System32\Drivers\Beep.SYS 0x90F1C000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0x90F23000 \SystemRoot\System32\drivers\vga.sys 0x90F2F000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x90F50000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x90F58000 \SystemRoot\system32\drivers\rdpencdd.sys 0x90F60000 \SystemRoot\System32\Drivers\Msfs.SYS 0x90F6B000 \SystemRoot\System32\Drivers\Npfs.SYS 0x90F79000 \SystemRoot\System32\DRIVERS\rasacd.sys 0x90F82000 \SystemRoot\system32\DRIVERS\tdx.sys 0x90F98000 \SystemRoot\system32\DRIVERS\smb.sys 0x90FAC000 \SystemRoot\system32\drivers\afd.sys 0x91005000 \SystemRoot\System32\DRIVERS\netbt.sys 0x91037000 \SystemRoot\system32\DRIVERS\pacer.sys 0x9104D000 \SystemRoot\system32\DRIVERS\vfilter.sys 0x91056000 \SystemRoot\system32\DRIVERS\netbios.sys 0x91064000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x91077000 \SystemRoot\system32\DRIVERS\ssmdrv.sys 0x9107D000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x910B9000 \SystemRoot\system32\drivers\nsiproxy.sys 0x910C3000 \SystemRoot\System32\Drivers\dfsc.sys 0x910DA000 \SystemRoot\system32\DRIVERS\avipbb.sys 0x91100000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys 0x91102000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0x91119000 \SystemRoot\system32\DRIVERS\USBD.SYS 0x9111B000 \SystemRoot\System32\Drivers\cvusbdrv.sys 0x91126000 \SystemRoot\system32\DRIVERS\usbccid.sys 0x91132000 \SystemRoot\system32\DRIVERS\SMCLIB.SYS 0x9113D000 \SystemRoot\System32\Drivers\crashdmp.sys 0x8C315000 \SystemRoot\System32\Drivers\dump_iaStor.sys 0x9114A000 \SystemRoot\system32\DRIVERS\hidusb.sys 0x91153000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0x91163000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0x99C40000 \SystemRoot\System32\win32k.sys 0x9116C000 \SystemRoot\System32\drivers\Dxapi.sys 0x91176000 \SystemRoot\system32\DRIVERS\mouhid.sys 0x9117E000 \SystemRoot\system32\DRIVERS\monitor.sys 0x99E60000 \SystemRoot\System32\TSDDD.dll 0x99E80000 \SystemRoot\System32\cdd.dll 0x9118D000 \SystemRoot\system32\drivers\luafv.sys 0x911A8000 \SystemRoot\system32\DRIVERS\WavxDMgr.sys 0x911DF000 \SystemRoot\system32\DRIVERS\avgntflt.sys 0x8C1DE000 \SystemRoot\system32\DRIVERS\lltdio.sys 0x807CF000 \SystemRoot\system32\DRIVERS\nwifi.sys 0x911F4000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0x9EE05000 \SystemRoot\system32\DRIVERS\rspndr.sys 0x9EE18000 \SystemRoot\system32\drivers\spsys.sys 0x9EEC8000 \SystemRoot\system32\drivers\HTTP.sys 0x9EF35000 \SystemRoot\System32\DRIVERS\srvnet.sys 0x9EF52000 \SystemRoot\system32\DRIVERS\bowser.sys 0x9EF6B000 \SystemRoot\System32\drivers\mpsdrv.sys 0x9EF80000 \SystemRoot\system32\drivers\mrxdav.sys 0x9EFA1000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0x9EFC0000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0x9FE07000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0x9FE1F000 \SystemRoot\System32\DRIVERS\srv2.sys 0x9FE47000 \SystemRoot\System32\DRIVERS\srv.sys 0x9FE95000 \SystemRoot\System32\Drivers\fastfat.SYS 0x9FEBD000 \SystemRoot\system32\drivers\peauth.sys 0x9FF9B000 \SystemRoot\System32\Drivers\secdrv.SYS 0x9FFA5000 \SystemRoot\System32\drivers\tcpipreg.sys 0x9FFC0000 \SystemRoot\system32\DRIVERS\cdfs.sys 0x77520000 \Windows\System32\ntdll.dll Processes (total 85): 0 System Idle Process 4 System 432 C:\Windows\System32\smss.exe 564 csrss.exe 616 C:\Windows\System32\wininit.exe 624 csrss.exe 660 C:\Windows\System32\services.exe 672 C:\Windows\System32\lsass.exe 680 C:\Windows\System32\lsm.exe 844 C:\Windows\System32\svchost.exe 908 C:\Windows\System32\nvvsvc.exe 936 C:\Windows\System32\svchost.exe 972 C:\Windows\System32\svchost.exe 1024 C:\Windows\System32\svchost.exe 1056 C:\Windows\System32\svchost.exe 1072 C:\Windows\System32\svchost.exe 1104 C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_38163857\stacsv.exe 1180 C:\Windows\System32\winlogon.exe 1220 C:\Windows\System32\audiodg.exe 1268 C:\Windows\System32\SLsvc.exe 1312 C:\Windows\System32\svchost.exe 1436 C:\Windows\System32\svchost.exe 1688 C:\Windows\System32\rundll32.exe 1736 C:\Windows\System32\wlanext.exe 1868 C:\Windows\System32\spoolsv.exe 1900 C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostControlService.exe 1912 C:\Program Files\Broadcom Corporation\Broadcom USH Host Components\CV\bin\HostStorageService.exe 1968 C:\Program Files\Avira\AntiVir Desktop\sched.exe 1980 C:\Windows\System32\svchost.exe 2080 C:\Windows\System32\taskeng.exe 2148 C:\Windows\System32\taskeng.exe 2244 C:\Program Files\Google\Update\GoogleUpdate.exe 2484 C:\Program Files\Dell\Dell ControlPoint\Connection Manager\SMManager.exe 2520 C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_38163857\AEstSrv.exe 2536 C:\Program Files\Dell\Ambient Light Sensor\AlsSvc.exe 2596 WmiPrvSE.exe 2752 C:\Program Files\Avira\AntiVir Desktop\avguard.exe 2772 C:\Program Files\Intel\ASF Agent\ASFAgent.exe 2792 C:\Windows\System32\svchost.exe 2808 C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe 2840 C:\Program Files\Dell\Dell ControlPoint\DCPButtonSvc.exe 2868 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe 2892 C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgrSvc.exe 2944 C:\Program Files\ShrewSoft\VPN Client\dtpd.exe 2988 C:\Program Files\Intel\WiFi\bin\EvtEng.exe 3068 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe 3096 C:\Program Files\ShrewSoft\VPN Client\iked.exe 3196 C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe 3244 C:\Program Files\Intel\AMT\lms.exe 3300 C:\Windows\System32\svchost.exe 3316 C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe 3352 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe 3400 C:\Windows\System32\svchost.exe 3424 C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe 3544 C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe 3668 C:\Windows\System32\svchost.exe 3692 C:\Windows\System32\SearchIndexer.exe 3740 C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe 336 C:\Windows\System32\dwm.exe 2888 C:\Windows\explorer.exe 3192 C:\Program Files\DellTPad\Apoint.exe 3284 C:\Windows\System32\rundll32.exe 3384 C:\Windows\System32\rundll32.exe 3676 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe 3820 C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe 2220 C:\Program Files\Dell\Dell ControlPoint\Dell.ControlPoint.exe 3928 C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe 868 C:\Windows\vsnpstd3.exe 1648 C:\Program Files\DellTPad\ApMsgFwd.exe 1564 C:\Program Files\DellTPad\hidfind.exe 1588 C:\Program Files\DellTPad\ApntEx.exe 3332 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 2420 C:\Program Files\Wave Systems Corp\SecureUpgrade.exe 2544 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe 2348 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe 804 C:\Program Files\Dell\Dell ControlPoint\System Manager\DCPSysMgr.exe 2852 C:\Program Files\Mozilla Firefox\firefox.exe 3480 C:\Windows\System32\svchost.exe 4760 C:\Windows\System32\wbem\WMIADAP.exe 5920 C:\Windows\System32\SearchProtocolHost.exe 4192 C:\Windows\System32\SearchFilterHost.exe 4600 dllhost.exe 5260 dllhost.exe 5912 C:\Users\***\Desktop\MBRCheck.exe 4892 C:\Windows\System32\conime.exe \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`91b00000 (NTFS) \\.\D: --> \\.\PhysicalDrive0 at offset 0x00000000`11b00000 (NTFS) PhysicalDrive0 Model Number: WDCWD1600BJKT-75F4T0, Rev: 11.01A11 Size Device Name MBR Status -------------------------------------------- 149 GB \\.\PhysicalDrive0 Windows Vista MBR code detected SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979 Done! |
|
| Themen zu Computer langsam und stürtzt häufig ab |
| andere, anderen, bildschirm, computer, computer langsam, einiger, enthält, firefox, funktioniert, gefundenen, gelöscht, gestartet, installiert, interne, internet, komplette, langsam, laufwerk, log-files, löschen, löschen?, neu, sehr langsam, sofort, sonderzeichen, stream, stürtzt, system |
Linear-Darstellung
