Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 27.05.2011, 20:00   #1
weddeltown
 
Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons - Standard

Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons



Hallo,
ich bin bei der Suche, was die komische Fehlermeldung "Festplatte defekt" zu bedeuten hat, sofort bei Euch gelandet. Mein Rechner hat anscheinend auch die Seuche. Ich hoffe, Ihr könnt mir helfen. Die OTL und Malwarebyte-Scans habe ich durchgeführt und beigefügt.
Was mir noch aufgefallen ist: Wenn man die vielen Fehlermeldungen stehen lässt, scheint der Rechner nicht von allein runter zu fahren.
Betriebssystem: Windows Vista Home Edition

Grüße

OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 27.05.2011 20:47:09 - Run 2
OTL by OldTimer - Version 3.2.23.0     Folder = I:\
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 1,66 Gb Available Physical Memory | 51,09% Memory free
6,69 Gb Paging File | 5,37 Gb Available in Paging File | 80,30% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 444,18 Gb Total Space | 52,57 Gb Free Space | 11,84% Space Free | Partition Type: NTFS
Drive D: | 21,57 Gb Total Space | 13,91 Gb Free Space | 64,50% Space Free | Partition Type: FAT32
Drive I: | 1,96 Gb Total Space | 1,95 Gb Free Space | 99,59% Space Free | Partition Type: FAT
 
Computer Name: PAPA-PC | User Name: Papa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - I:\OTL.exe (OldTimer Tools)
PRC - C:\ProgramData\ceeiLjmUBGBADu.exe (Microsoft Corporation)
PRC - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
PRC - C:\Programme\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft Limited)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Windows\System32\DV4TS.EXE (Tobit.Software)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
PRC - C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\Winamp\winampa.exe (Nullsoft, Inc.)
PRC - C:\Programme\Sony\Content Transfer\ContentTransferWMDetector.exe (Sony Corporation)
PRC - C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conime.exe (Microsoft Corporation)
PRC - C:\Programme\CyberLink\Shared Files\brs.exe (cyberlink)
PRC - C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe ()
PRC - C:\Programme\HomeCinema\PowerDVD\PDVDServ.exe (Cyberlink Corp.)
PRC - C:\Programme\Lexmark 3600-4600 Series\lxdxmsdmon.exe ()
PRC - C:\Programme\Lexmark 3600-4600 Series\lxdxmon.exe ()
PRC - C:\Windows\System32\lxdxcoms.exe ( )
PRC - C:\Windows\System32\spool\drivers\w32x86\3\lxdxserv.exe (Lexmark International, Inc.)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Programme\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe ()
PRC - C:\Programme\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe ()
PRC - C:\Programme\HomeCinema\TV Enhance\TVEService.exe (CyberLink Corp.)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
PRC - C:\Programme\HomeCinema\PlayMovie\PMVService.exe (CyberLink Corp.)
PRC - C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
PRC - C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG)
PRC - C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
PRC - C:\Programme\Philips\Philips SPC210NC Webcam\TrayMin210.exe ()
PRC - C:\Windows\VM_STI.EXE (BIGDOG)
PRC - C:\Programme\Common Files\X10\Common\X10nets.exe (X10)
 
 
========== Modules (SafeList) ==========
 
MOD - I:\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Lavasoft Ad-Aware Service) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (vsmon) -- C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD)
SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (AAV UpdateService) -- C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe ()
SRV - (lxdx_device) -- C:\Windows\System32\lxdxcoms.exe ( )
SRV - (lxdxCATSCustConnectService) -- C:\Windows\System32\spool\DRIVERS\W32X86\3\\lxdxserv.exe ()
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (TVECapSvc) TVEnhance Background Capture Service (TBCS) -- C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe ()
SRV - (TVESched) TVEnhance Task Scheduler (TTS)) -- C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe ()
SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation)
SRV - (x10nets) -- C:\Programme\Common Files\X10\Common\X10nets.exe (X10)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (Lavasoft Kernexplorer) -- C:\Programme\Lavasoft\Ad-Aware\kernexplorer.sys ()
DRV - (Lbd) -- C:\Windows\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (Vsdatant) -- C:\Windows\System32\drivers\vsdatant.sys (Check Point Software Technologies LTD)
DRV - (avmaudio) -- C:\Windows\System32\drivers\avmaudio.sys (AVM Berlin)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (epmntdrv) -- C:\Windows\System32\epmntdrv.sys ()
DRV - (EuGdiDrv) -- C:\Windows\System32\EuGdiDrv.sys ()
DRV - ({95808DC4-FA4A-4C74-92FE-5B863F82066B}) -- C:\Programme\HomeCinema\PowerDVD\000.fcl (CyberLink Corp.)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (IntelDH) -- C:\Windows\System32\drivers\IntelDH.sys (Intel Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (WSDPrintDevice) -- C:\Windows\System32\drivers\WSDPrint.sys (Microsoft Corporation)
DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- C:\Programme\HomeCinema\PlayMovie\000.fcl (Cyberlink Corp.)
DRV - (netr28u) -- C:\Windows\System32\drivers\netr28u.sys (Ralink Technology Corp.)
DRV - (3xHybrid) -- C:\Windows\System32\drivers\3xHybrid.sys (NXP Semiconductors Germany GmbH)
DRV - (e1express) Intel(R) -- C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (XUIF) -- C:\Windows\System32\drivers\x10ufx2.sys (X10 Wireless Technology, Inc.)
DRV - (X10Hid) -- C:\Windows\System32\drivers\x10hid.sys (X10 Wireless Technology, Inc.)
DRV - (ZSMC301b) -- C:\Windows\System32\drivers\usbVM31b.sys (VM)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultthis.engineName: "ZoneAlarm-Sicherheit Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "ZoneAlarm-Sicherheit Customized Web Search"
FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2613550&SearchSource=13"
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {E5886C91-CDD7-4832-B32D-0830705A9C60}:1.0
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.04.28 20:41:10 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.04.28 20:41:10 | 000,000,000 | ---D | M]
 
[2009.10.17 16:36:23 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Papa\AppData\Roaming\mozilla\Extensions
[2011.05.27 20:21:27 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Papa\AppData\Roaming\mozilla\Firefox\Profiles\uras7n3k.default\extensions
[2011.01.28 17:00:09 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Papa\AppData\Roaming\mozilla\Firefox\Profiles\uras7n3k.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.10.14 21:33:48 | 000,000,000 | -H-D | M] ("DVDVideoSoft Menu") -- C:\Users\Papa\AppData\Roaming\mozilla\Firefox\Profiles\uras7n3k.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.01.17 15:41:40 | 000,000,943 | -H-- | M] () -- C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\uras7n3k.default\searchplugins\conduit.xml
[2011.03.08 18:48:06 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.05.08 10:50:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.09.12 19:46:56 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.11.13 15:22:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.01.22 18:17:00 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.03.08 18:48:06 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2010.02.27 20:45:58 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
[2009.11.09 20:05:30 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
[2010.04.01 20:00:19 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
[2010.05.08 10:50:36 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.09.12 19:46:56 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.11.13 15:22:59 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.01.22 18:17:00 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.03.08 18:48:06 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.03.22 22:01:18 | 000,000,000 | -H-D | M] (Java String Helper) -- C:\USERS\PAPA\APPDATA\ROAMING\5012
[2011.02.02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.01.14 00:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npwachk.dll
[2011.04.28 20:41:04 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2011.04.28 20:41:04 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2011.04.28 20:41:04 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2011.04.28 20:41:05 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2011.04.28 20:41:05 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [BDRegion] C:\Programme\CyberLink\Shared Files\brs.exe (cyberlink)
O4 - HKLM..\Run: [BigDogPath] C:\Windows\VM_STI.EXE (BIGDOG)
O4 - HKLM..\Run: [ContentTransferWMDetector.exe] C:\Programme\Sony\Content Transfer\ContentTransferWMDetector.exe (Sony Corporation)
O4 - HKLM..\Run: [DV4TS.EXE] C:\Windows\System32\DV4TS.EXE (Tobit.Software)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\HomeCinema\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [lxdxamon] C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe ()
O4 - HKLM..\Run: [lxdxmon.exe] C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PlayMovie] C:\Program Files\HomeCinema\PlayMovie\PMVService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl] C:\Program Files\HomeCinema\PowerDVD\PDVDServ.exe (Cyberlink Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [toolbar_eula_launcher] C:\Programme\GoogleEULA\EULALauncher.exe ( )
O4 - HKLM..\Run: [TVEService] C:\Program Files\HomeCinema\TV Enhance\TVEService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files\HomeCinema\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD)
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)
O4 - HKCU..\Run: [ceeiLjmUBGBADu] C:\ProgramData\ceeiLjmUBGBADu.exe (Microsoft Corporation)
O8 - Extra context menu item: Free YouTube Download - C:\Users\Papa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Papa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.42.0.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.05.27 18:29:19 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
[2011.05.26 22:52:14 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Roaming\Malwarebytes
[2011.05.26 22:52:04 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.05.26 22:52:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.05.26 22:52:02 | 000,000,000 | -H-D | C] -- C:\ProgramData\Malwarebytes
[2011.05.26 22:51:59 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.05.26 22:51:59 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.05.26 21:34:05 | 000,365,056 | -H-- | C] (Microsoft Corporation) -- C:\ProgramData\34660088.exe
[2011.05.26 21:24:02 | 000,473,600 | -H-- | C] (Microsoft Corporation) -- C:\ProgramData\ceeiLjmUBGBADu.exe
[2011.05.15 19:12:22 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Roaming\Amazon
[2011.05.15 19:11:07 | 000,000,000 | ---D | C] -- C:\Programme\Amazon
[2011.05.15 19:11:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon
[2011.05.15 12:13:48 | 000,000,000 | -H-D | C] -- C:\Users\Papa\Documents\Logopak
[2011.03.22 21:47:08 | 000,236,496 | -H-- | C] (Adobe Systems, Incorporated) -- C:\Users\Papa\AppData\Roaming\AcroIEHelpe.dll
[2009.02.13 23:07:56 | 000,438,272 | ---- | C] ( ) -- C:\Windows\System32\LXDXhcp.dll
[2009.02.13 23:07:56 | 000,364,544 | ---- | C] ( ) -- C:\Windows\System32\lxdxinpa.dll
[2009.02.13 23:07:55 | 001,105,920 | ---- | C] ( ) -- C:\Windows\System32\lxdxserv.dll
[2009.02.13 23:07:55 | 000,843,776 | ---- | C] ( ) -- C:\Windows\System32\lxdxusb1.dll
[2009.02.13 23:07:55 | 000,339,968 | ---- | C] ( ) -- C:\Windows\System32\lxdxiesc.dll
[2009.02.13 23:07:55 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\lxdxprox.dll
[2009.02.13 23:07:54 | 000,647,168 | ---- | C] ( ) -- C:\Windows\System32\lxdxpmui.dll
[2009.02.13 23:07:54 | 000,569,344 | ---- | C] ( ) -- C:\Windows\System32\lxdxlmpm.dll
[2009.02.13 23:07:53 | 000,663,552 | ---- | C] ( ) -- C:\Windows\System32\lxdxhbn3.dll
[2009.02.13 23:07:53 | 000,320,168 | ---- | C] ( ) -- C:\Windows\System32\lxdxih.exe
[2009.02.13 23:07:52 | 000,851,968 | ---- | C] ( ) -- C:\Windows\System32\lxdxcomc.dll
[2009.02.13 23:07:52 | 000,594,600 | ---- | C] ( ) -- C:\Windows\System32\lxdxcoms.exe
[2009.02.13 23:07:52 | 000,376,832 | ---- | C] ( ) -- C:\Windows\System32\lxdxcomm.dll
[2009.02.13 23:07:52 | 000,365,224 | ---- | C] ( ) -- C:\Windows\System32\lxdxcfg.exe
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Users\Papa\AppData\Roaming\*.tmp files -> C:\Users\Papa\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.05.27 20:28:53 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.05.27 20:28:53 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.05.27 18:36:17 | 000,638,510 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.05.27 18:36:17 | 000,604,126 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.05.27 18:36:17 | 000,130,462 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.05.27 18:36:17 | 000,107,562 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.05.27 18:28:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.05.27 18:28:50 | 3485,696,000 | -HS- | M] () -- C:\hiberfil.sys
[2011.05.26 21:10:37 | 000,000,064 | ---- | M] () -- C:\Windows\System32\rp_stats.dat
[2011.05.26 21:10:37 | 000,000,044 | ---- | M] () -- C:\Windows\System32\rp_rules.dat
[2011.05.24 18:30:48 | 000,002,615 | -H-- | M] () -- C:\Users\Papa\Desktop\FlatOut2.lnk
[2011.05.15 11:41:33 | 000,000,563 | ---- | M] () -- C:\Windows\Tobit.ini
[2011.04.30 12:45:21 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat
[2011.04.30 12:45:21 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat
[2011.04.30 12:45:13 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2011.04.29 13:24:35 | 004,175,872 | ---- | M] (Tobit.Software) -- C:\Windows\DVAPI32.DLL
[2011.04.28 16:07:37 | 008,420,352 | ---- | M] () -- C:\Windows\TOBITCLT.DLL
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ]
[1 C:\Users\Papa\AppData\Roaming\*.tmp files -> C:\Users\Papa\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.05.08 12:43:56 | 000,000,064 | ---- | C] () -- C:\Windows\System32\rp_stats.dat
[2011.05.08 12:43:56 | 000,000,044 | ---- | C] () -- C:\Windows\System32\rp_rules.dat
[2011.04.30 12:45:13 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2011.01.23 16:53:31 | 000,016,432 | ---- | C] () -- C:\Windows\System32\lsdelete.exe
[2011.01.16 19:47:05 | 000,000,056 | ---- | C] () -- C:\Windows\cryavitowmv.ini
[2011.01.16 16:06:16 | 000,000,005 | ---- | C] () -- C:\Windows\System32\SySavitowmv.dat
[2010.10.23 13:31:52 | 000,152,064 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2010.06.18 13:34:43 | 000,007,592 | -H-- | C] () -- C:\Users\Papa\AppData\Local\d3d9caps.dat
[2010.01.31 20:44:34 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll
[2010.01.31 20:44:34 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe
[2009.10.27 21:25:04 | 000,114,688 | ---- | C] () -- C:\Windows\DVGRF.DLL
[2009.10.27 21:25:04 | 000,086,016 | ---- | C] () -- C:\Windows\System32\IMGMSGMO.dll
[2009.10.27 21:24:55 | 008,420,352 | ---- | C] () -- C:\Windows\TOBITCLT.DLL
[2009.10.27 21:24:55 | 000,000,023 | ---- | C] () -- C:\Windows\AVFD.INI
[2009.10.27 21:24:31 | 000,000,563 | ---- | C] () -- C:\Windows\Tobit.ini
[2009.09.25 18:23:45 | 001,663,488 | ---- | C] () -- C:\Windows\System32\BootMan.exe
[2009.09.25 18:23:45 | 000,086,408 | ---- | C] () -- C:\Windows\System32\setupempdrv03.exe
[2009.09.25 18:23:45 | 000,014,848 | ---- | C] () -- C:\Windows\System32\EuEpmGdi.dll
[2009.09.25 18:23:45 | 000,009,728 | ---- | C] () -- C:\Windows\System32\epmntdrv.sys
[2009.09.25 18:23:45 | 000,003,072 | ---- | C] () -- C:\Windows\System32\EuGdiDrv.sys
[2009.09.18 20:02:04 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.09.18 20:02:04 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.05.05 17:52:46 | 000,000,000 | -H-- | C] () -- C:\Users\Papa\AppData\Roaming\Default.PLS
[2009.02.22 13:26:25 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009.02.16 21:19:24 | 000,032,256 | -H-- | C] () -- C:\Users\Papa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.02.15 19:06:03 | 000,000,000 | -H-- | C] () -- C:\Users\Papa\AppData\Roaming\wklnhst.dat
[2009.02.13 23:11:09 | 000,360,448 | ---- | C] () -- C:\Windows\System32\lxdxcoin.dll
[2009.02.13 23:10:37 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxdxvs.dll
[2009.02.13 23:09:41 | 000,782,336 | ---- | C] () -- C:\Windows\System32\lxdxdrs.dll
[2009.02.13 23:09:41 | 000,081,920 | ---- | C] () -- C:\Windows\System32\lxdxcaps.dll
[2009.02.13 23:09:41 | 000,069,632 | ---- | C] () -- C:\Windows\System32\lxdxcnv4.dll
[2009.02.13 23:08:16 | 000,000,044 | ---- | C] () -- C:\Windows\System32\lxdxrwrd.ini
[2009.02.13 23:07:56 | 000,348,160 | ---- | C] () -- C:\Windows\System32\LXDXinst.dll
[2009.02.13 23:07:53 | 000,208,896 | ---- | C] () -- C:\Windows\System32\lxdxgrd.dll
[2009.02.13 21:56:24 | 000,000,092 | -H-- | C] () -- C:\Users\Papa\AppData\Local\fusioncache.dat
[2007.12.20 11:20:42 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2007.12.19 16:44:01 | 000,127,184 | ---- | C] () -- C:\Windows\Unwise.exe
[2007.10.25 13:29:33 | 000,009,824 | ---- | C] () -- C:\Windows\System32\34CoInstaller.dll
[2006.11.02 17:33:31 | 000,638,510 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,130,462 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,316,056 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,604,126 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,107,562 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
 
========== LOP Check ==========
 
[2011.03.22 22:01:18 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\5012
[2011.05.15 19:12:22 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\Amazon
[2011.01.23 19:34:39 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\CheckPoint
[2011.01.08 01:21:45 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\DVDVideoSoft
[2011.01.08 01:21:57 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.01.16 20:20:01 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\GetRightToGo
[2009.02.13 23:29:33 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\GHISLER
[2010.07.06 20:43:27 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\gtk-2.0
[2011.01.16 16:15:39 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\HandBrake
[2009.02.22 21:02:38 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\IrfanView
[2011.03.22 21:46:57 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\kock
[2009.02.13 23:52:04 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\Lexmark Productivity Studio
[2010.06.24 20:17:24 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\Nokia
[2009.02.14 21:54:13 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\OpenOffice.org
[2010.06.24 20:17:22 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\PC Suite
[2009.09.01 20:57:56 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\T-Online
[2010.01.03 15:42:26 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\Template
[2011.03.26 11:43:34 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\Tobit
[2011.03.26 12:03:49 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\UAs
[2011.03.26 12:06:05 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\xmldm
[2011.05.27 18:27:44 | 000,032,554 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2009.02.13 21:56:22 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2009.09.21 22:15:42 | 000,000,000 | -HSD | M] -- C:\Boot
[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2009.02.13 21:52:43 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2007.12.19 14:08:39 | 000,000,000 | -H-D | M] -- C:\Intel
[2011.03.27 20:10:35 | 000,000,000 | -H-D | M] -- C:\Logopak
[2009.02.13 23:11:59 | 000,000,000 | -H-D | M] -- C:\logs
[2011.01.16 20:03:05 | 000,000,000 | -H-D | M] -- C:\My Video
[2009.06.05 21:06:31 | 000,000,000 | -H-D | M] -- C:\MyWorks
[2009.03.12 17:34:56 | 000,000,000 | -H-D | M] -- C:\OETINGER
[2009.02.20 19:31:35 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2009.03.22 17:32:54 | 000,000,000 | -H-D | M] -- C:\Phenomedia AG
[2011.05.26 22:55:07 | 000,000,000 | R--D | M] -- C:\Programme
[2011.05.26 22:52:02 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2009.02.13 21:52:43 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.05.27 20:48:21 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2010.10.21 20:50:55 | 000,000,000 | -H-D | M] -- C:\TEMP
[2010.01.19 17:40:15 | 000,000,000 | -H-D | M] -- C:\totalcmd
[2009.08.16 21:07:36 | 000,000,000 | R--D | M] -- C:\Users
[2011.04.20 21:40:35 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2007.12.19 14:02:36 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2007.12.19 14:02:36 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008.01.19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe
[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe
[2006.11.02 11:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_f1f7f368deed95c3\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-27 15:58:27
 
< End of report >
         
--- --- ---


OTL EXTRAS Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 27.05.2011 18:35:32 - Run 1
OTL by OldTimer - Version 3.2.23.0     Folder = I:\
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 1,91 Gb Available Physical Memory | 58,91% Memory free
6,68 Gb Paging File | 5,43 Gb Available in Paging File | 81,20% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 444,18 Gb Total Space | 52,63 Gb Free Space | 11,85% Space Free | Partition Type: NTFS
Drive D: | 21,57 Gb Total Space | 13,91 Gb Free Space | 64,50% Space Free | Partition Type: FAT32
Drive I: | 1,96 Gb Total Space | 1,95 Gb Free Space | 99,60% Space Free | Partition Type: FAT
 
Computer Name: PAPA-PC | User Name: Papa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{5EC22E80-0293-44E0-AC96-CB5BC4F80814}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{80F850DC-E6CD-400D-AA74-8736302C9DE6}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
"{8C16A2C8-EE5B-4EDD-92BF-09EC38922D1A}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{A6851F42-E12A-49E0-B7EB-2DEAFB8B66BB}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{011961B7-6FBD-464D-AEF3-FEF8A581C7D2}" = protocol=17 | dir=in | app=c:\users\papa\appdata\local\apps\2.0\oxoaa3r7.x0r\50voyte8.7km\frit..tion_f8d772dfbb3f7453_0002.0001_0db5bf169ed5c0c1\fritzbox-usb-fernanschluss.exe | 
"{171FA388-3ECB-4883-87D5-09AE437A1D74}" = protocol=6 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe | 
"{2381DC59-A92D-407E-89A9-51DB20D57508}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{293F2135-7BDA-4757-A5E6-51D2DFB97C1F}" = protocol=6 | dir=in | app=c:\users\papa\appdata\local\apps\2.0\oxoaa3r7.x0r\50voyte8.7km\frit..tion_f8d772dfbb3f7453_0002.0001_0db5bf169ed5c0c1\fritzbox-usb-fernanschluss.exe | 
"{2E154FDF-F672-46EA-8D24-5B38982CB782}" = dir=in | app=c:\program files\homecinema\makedisc\makedisc.exe | 
"{2F59AC89-EDD5-45AE-BB19-1FE4AB27597B}" = protocol=17 | dir=in | app=c:\program files\lexmark 3600-4600 series\frun.exe | 
"{34A08932-3034-4AF1-9FCF-F92F5F1496A1}" = protocol=6 | dir=in | app=c:\program files\lexmark 3600-4600 series\lxdxmon.exe | 
"{3831ECAC-409B-46B7-8A72-26F0E1EE3D70}" = dir=in | app=c:\program files\homecinema\playmovie\playmovie.exe | 
"{430505F4-5C6C-4E24-85E1-1668203DBDB2}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdxtime.exe | 
"{4784A495-0C91-40B0-BBED-CB8482CA52CC}" = protocol=6 | dir=in | app=c:\windows\system32\lxdxcoms.exe | 
"{488853FA-2BDF-4399-8F04-621777C1258F}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{4CE35CFD-E885-4580-B448-0B7A3D4ED3D2}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdxtime.exe | 
"{56CF16AE-63AE-401A-B991-D7AADA7CD602}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{5E50D890-6062-4332-8C7D-DDBE00432894}" = protocol=17 | dir=in | app=c:\windows\system32\lxdxcoms.exe | 
"{62BFAB41-46F9-4791-B0AE-C04B658612CD}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdxpswx.exe | 
"{64652769-BF67-4B69-A3DD-7FBB73ED84E6}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdxjswx.exe | 
"{6C9D0670-5EEC-46F5-97C0-BD2D3C6DD2BD}" = protocol=6 | dir=in | app=c:\program files\lexmark 3600-4600 series\lxdxamon.exe | 
"{6EC4452F-E9EA-4316-956F-D9EF1A8FF1C8}" = protocol=17 | dir=in | app=c:\program files\lexmark 3600-4600 series\lxdxamon.exe | 
"{7CC91D09-5C5A-4532-9E6B-716651EC9D8F}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{7D4D5B8F-6652-45BF-96DF-DBD7F44F46C0}" = protocol=17 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe | 
"{90E2670F-DE2C-488A-BBB2-5981F73CAEFC}" = protocol=6 | dir=in | app=c:\program files\lexmark 3600-4600 series\frun.exe | 
"{95D75C42-D075-4B3F-B2D1-66150A000304}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 
"{A10690A3-9E5F-493E-99A1-2C4EBD19C48E}" = protocol=17 | dir=in | app=c:\windows\system32\lxdxcfg.exe | 
"{B095F7B7-A711-4C11-B4F3-E833264DDD73}" = protocol=17 | dir=in | app=c:\program files\lexmark 3600-4600 series\lxdxmon.exe | 
"{BA192D85-B974-4532-BF0A-C164F3AB81A2}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdxjswx.exe | 
"{BB6659CA-BCAE-49BF-821E-48F6825A3A66}" = dir=in | app=c:\program files\homecinema\powerdvd\powerdvd.exe | 
"{D9BA0D3D-4C03-4B90-9375-B380C9F4C071}" = dir=in | app=c:\program files\homecinema\tv enhance\tvenhance.exe | 
"{E0297CAE-8DA1-4289-BAA6-E437BEBDC542}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdxpswx.exe | 
"{E40CB1B4-CCCE-4EFF-A0A3-A83E274DA87F}" = dir=in | app=c:\program files\homecinema\playmovie\pmvservice.exe | 
"{F37CFA66-E0B5-49EE-9793-52F58645381B}" = dir=in | app=c:\program files\homecinema\tv enhance\tveservice.exe | 
"{F863DC61-C4BB-4840-8F65-1FCCA7BDDB67}" = protocol=6 | dir=in | app=c:\windows\system32\lxdxcfg.exe | 
"TCP Query User{0B2323EA-52DF-41B7-9A64-A715C345544D}C:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe | 
"TCP Query User{51969177-B94D-453C-B6E5-00AF56E99D9C}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"TCP Query User{5605F5CB-686D-43A7-BF80-F9DA08B400B6}C:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\extra1\bin\settlershok.exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\extra1\bin\settlershok.exe | 
"TCP Query User{BBBDFB24-C414-49D6-A379-1D362401C764}C:\program files\lexmark 3600-4600 series\lxdxlscn.exe" = protocol=6 | dir=in | app=c:\program files\lexmark 3600-4600 series\lxdxlscn.exe | 
"UDP Query User{136E9409-D69A-47DA-A1AB-719242137ED7}C:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\extra1\bin\settlershok.exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\extra1\bin\settlershok.exe | 
"UDP Query User{4F3F1D3F-39FA-4F5E-A37E-E74966A3BAF3}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{61F91B3C-D96B-40F1-A9F9-C2DF4C38D7B1}C:\program files\lexmark 3600-4600 series\lxdxlscn.exe" = protocol=17 | dir=in | app=c:\program files\lexmark 3600-4600 series\lxdxlscn.exe | 
"UDP Query User{85818B43-EB53-4145-A541-9AEE6B969342}C:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{089DD780-DB3F-4CDB-A0C2-111360247298}" = PC Connectivity Solution
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{202BACA0-AA91-11D4-A5EE-004095501894}" = Wendy
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 24
"{26A24AE4-039D-4CA4-87B4-2F83216016F0}" = Java(TM) 6 Update 16
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{32E00E5E-22B1-4D5A-9DC2-CD75E087A5E6}" = Steuer-Spar-Erklärung 2009
"{38D95956-E92C-4473-904B-CD877EA04410}" = Philips SPC210NC Webcam 
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = CyberLink PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{7655E113-C306-11D9-A373-0050BAE317E1}" = MCE Software Encoder 1.1
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78C81F94-6510-4EDF-8397-2D0932608F35}_is1" = TOPP Vorlagen-Druckstudio (3560)
"{7E641E46-81DB-4D1D-906A-48342523051C}" = FlatOut2
"{81AB1374-098A-43CB-BE57-31CEB5EB1031}" = Nero 7 Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D7E5329-5751-435B-B585-0EFF51783A20}" = NWZ-E350 WALKMAN Guide
"{9F5FD796-86F0-4360-85F8-D54C0F5411EB}" = Steuer-Spar-Erklärung 2011
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A14C40E7-F7E5-498D-B8BD-A3EAE942EED0}" = LEGO® Indiana Jones™
"{A450831D-25F6-4F42-9662-D000B25E0D82}" = Play Movie
"{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.1 - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B145EC69-66F5-11D8-9D75-000129760D75}" = MakeDisc
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{B82157D3-6D31-4650-93B4-FC39BB08D6CE}" = AAVUpdateManager
"{BBBF4CFE-9D26-4D93-A869-B2B021B3CA85}" = Intel(R) PRO Network Connections 12.2.41.0
"{C1E11C46-E6EB-4BD2-9ADF-2A98ACBEB216}" = iTunes
"{C5FC10F2-F93D-4083-8303-EA6327FF94D3}" = Lars der kleine Eisbär
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFADE4AF-C0CF-4A04-A776-741318F1658F}" = Content Transfer
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D8E1DFEE-622B-46BA-AEFF-AB7E541C0B21}" = Steuer-Spar-Erklärung 2010
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E08DE897-B6AF-4DFF-9E90-131E80C876B4}" = DIE SIEDLER - Das Erbe der Könige - Gold Edition
"{E1180142-3B31-4DCC-9D27-7AC2D37662BF}" = LightScribe  1.4.124.1
"{E4C891D6-6844-41B8-86E8-633CACCC644F}" = TV Enhance
"{ED1390DC-6910-4C77-97E2-579CAFE82F5B}" = Moorhuhn 4 Teile
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Ad-Aware" = Ad-Aware
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CDex" = CDex extraction audio
"Cossacks : Back To War" = Cossacks - Back To War
"David Client" = David Client 
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 4.0 Home Edition
"Flight Simulator 9.0" = Microsoft Flight Simulator 2004 - Das Jahrhundert der Luftfahrt
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.1
"Free Studio_is1" = Free Studio version 5.0.3
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2
"FreePDF_XP" = FreePDF (Remove only)
"GPL Ghostscript 8.70" = GPL Ghostscript 8.70
"InstallShield_{A14C40E7-F7E5-498D-B8BD-A3EAE942EED0}" = LEGO® Indiana Jones™
"IrfanView" = IrfanView (remove only)
"Lexmark 3600-4600 Series" = Lexmark 3600-4600 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.5.16)" = Mozilla Firefox (3.5.16)
"NVIDIA Drivers" = NVIDIA Drivers
"PROSetDX" = Intel(R) PRO Network Connections 12.2.41.0
"ProviStars - Die Log-O-Matic" = ProviStars - Die Log-O-Matic
"ratDVD" = ratDVD 0.78.1444
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"Totalcmd" = Total Commander (Remove or Repair)
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.5
"WBFS Manager 3.0" = WBFS Manager 3.0
"Winamp" = Winamp
"WinGimp-2.0_is1" = GIMP 2.6.9
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"Wise Registry Cleaner_is1" = Wise Registry Cleaner Free 5.33
"X10Hardware" = X10 Hardware(TM)
"ZoneAlarm" = ZoneAlarm
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f6791b188d8f3ff8" = AVM FRITZ!Box USB-Fernanschluss
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 07.09.2010 12:00:10 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 07.09.2010 12:00:10 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 07.09.2010 13:30:52 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 07.09.2010 13:30:52 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 08.09.2010 13:07:48 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 08.09.2010 13:07:49 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 09.09.2010 13:08:31 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 09.09.2010 13:08:31 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 10.09.2010 10:31:49 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
Error - 10.09.2010 10:31:49 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description = 
 
[ Media Center Events ]
Error - 28.02.2009 10:51:59 | Computer Name = Papa-PC | Source = ehRecvr | ID = 3
Description = 
 
Error - 28.02.2009 11:48:01 | Computer Name = Papa-PC | Source = ehRecvr | ID = 3
Description = 
 
Error - 28.02.2009 12:07:46 | Computer Name = Papa-PC | Source = ehRecvr | ID = 4
Description = 
 
Error - 18.05.2011 14:46:50 | Computer Name = Papa-PC | Source = ehSched | ID = 5
Description = CResourceMgr::GetEhepgdat Error GetEhepgdatDispatcher 0x80080005
 
[ System Events ]
Error - 18.05.2011 14:46:50 | Computer Name = Papa-PC | Source = DCOM | ID = 10010
Description = 
 
Error - 24.05.2011 10:37:32 | Computer Name = Papa-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 23.05.2011 um 19:08:48 unerwartet heruntergefahren.
 
Error - 26.05.2011 15:05:15 | Computer Name = Papa-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 24.05.2011 um 18:47:27 unerwartet heruntergefahren.
 
Error - 26.05.2011 15:38:17 | Computer Name = Papa-PC | Source = Service Control Manager | ID = 7022
Description = 
 
Error - 26.05.2011 16:23:41 | Computer Name = Papa-PC | Source = Service Control Manager | ID = 7022
Description = 
 
Error - 26.05.2011 16:52:07 | Computer Name = Papa-PC | Source = Service Control Manager | ID = 7022
Description = 
 
Error - 26.05.2011 17:16:09 | Computer Name = Papa-PC | Source = RasMan | ID = 20033
Description = Die RAS-Verbindungsverwaltung konnte nicht gestartet werden, da keine
 Registrierung bei der lokalen Sicherheitsinstanz ausgeführt werden konnte. Führen
 Sie einen Neustart der RAS-Verbindungsverwaltung aus. Falls das Problem weiterhin
 besteht, wenden Sie sich an den Systemadministrator. Unzulässige Funktion.  
 
Error - 27.05.2011 11:40:49 | Computer Name = Papa-PC | Source = Service Control Manager | ID = 7022
Description = 
 
Error - 27.05.2011 12:11:26 | Computer Name = Papa-PC | Source = Service Control Manager | ID = 7022
Description = 
 
Error - 27.05.2011 12:35:17 | Computer Name = Papa-PC | Source = Service Control Manager | ID = 7022
Description = 
 
 
< End of report >
         
--- --- ---


Malwarebytes' Anti-Malware 1.50.1.1100
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: 6693

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

27.05.2011 20:20:05
mbam-log-2011-05-27 (20-20-02).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 393740
Laufzeit: 1 Stunde(n), 25 Minute(n), 32 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 4
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4

Infizierte Speicherprozesse:
c:\programdata\ceeiljmubgbadu.exe (Trojan.FakeMS) -> 4144 -> No action taken.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CLASSES_ROOT\CLSID\{A3EF6FD4-4769-4734-9494-4707087225B9} (Trojan.Banker) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3EF6FD4-4769-4734-9494-4707087225B9} (Trojan.Banker) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{A3EF6FD4-4769-4734-9494-4707087225B9} (Trojan.Banker) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A3EF6FD4-4769-4734-9494-4707087225B9} (Trojan.Banker) -> No action taken.

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceeiLjmUBGBADu (Trojan.FakeMS) -> Value: ceeiLjmUBGBADu -> No action taken.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\programdata\ceeiljmubgbadu.exe (Trojan.FakeMS) -> No action taken.
c:\Users\Papa\AppData\Roaming\acroiehelpe.dll (Trojan.Banker) -> No action taken.
c:\programdata\34660088.exe (Trojan.FakeMS) -> No action taken.
c:\Users\Papa\AppData\Local\Temp\tmpAE39.tmp (Trojan.FakeMS) -> No action taken.

Alt 28.05.2011, 11:33   #2
markusg
/// Malware-holic
 
Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons - Standard

Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons



• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:
ATTFilter
:OTL
O4 - HKCU..\Run: [ceeiLjmUBGBADu] C:\ProgramData\ceeiLjmUBGBADu.exe (Microsoft Corporation)
[2011.05.26 21:34:05 | 000,365,056 | -H-- | C] (Microsoft Corporation) -- C:\ProgramData\34660088.exe
[2011.05.15 12:13:48 | 000,000,000 | -H-D | C] -- C:\Users\Papa\Documents\Logopak
[2011.03.22 21:47:08 | 000,236,496 | -H-- | C] (Adobe Systems, Incorporated) -- C:\Users\Papa\AppData\Roaming\AcroIEHelpe.dll

:Files
C:\ProgramData\ceeiLjmUBGBADu.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.


lade unhide:
http://www.trojaner-board.de/54791-a...ner-board.html
__________________

__________________

Alt 29.05.2011, 19:42   #3
weddeltown
 
Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons - Standard

Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons



Hallo,
erstmal vielen Dank für Eure Unterstützng. Den OTL-Fix Text habe ich unten angehängt.

Beim Booten des Rechners hat Anti-Vir erstmals den Trojaner "ceeiLjmUBGBADu.exe" gemeldet. Ich habe keine Aktion durchgeführt.
Nach(?!?) dem OTL-Fix hat Anti-Vir wieder den Trojaner "ceeiLjmUBGBADu.exe" gemeldet. Ich habe dann "Entfernen" gedrückt.

Grüße

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ceeiLjmUBGBADu deleted successfully.
File move failed. C:\ProgramData\ceeiLjmUBGBADu.exe scheduled to be moved on reboot.
C:\ProgramData\34660088.exe moved successfully.
C:\Users\Papa\Documents\Logopak folder moved successfully.
C:\Users\Papa\AppData\Roaming\AcroIEHelpe.dll moved successfully.
========== FILES ==========
File move failed. C:\ProgramData\ceeiLjmUBGBADu.exe scheduled to be moved on reboot.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Papa
->Flash cache emptied: 55880 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Papa
->Temp folder emptied: 877384413 bytes
->Temporary Internet Files folder emptied: 419080596 bytes
->Java cache emptied: 51415388 bytes
->FireFox cache emptied: 92611768 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 70966405 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 1.441,00 mb


OTL by OldTimer - Version 3.2.23.0 log created on 05292011_201605

Files\Folders moved on Reboot...
File move failed. C:\ProgramData\ceeiLjmUBGBADu.exe scheduled to be moved on reboot.
C:\Users\Papa\AppData\Local\Temp\~DF5387.tmp moved successfully.
File\Folder C:\Windows\temp\ZLT064b9.TMP not found!

Registry entries deleted on Reboot...


Grüße
__________________

Geändert von weddeltown (29.05.2011 um 20:01 Uhr)

Alt 30.05.2011, 11:02   #4
markusg
/// Malware-holic
 
Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons - Standard

Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons



bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 31.05.2011, 18:54   #5
weddeltown
 
Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons - Standard

Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons



Hallo,

unten stehend die Log-Datei von ComboFix.

Grüße

Combofix Logfile:
Code:
ATTFilter
ComboFix 11-05-31.01 - Papa 31.05.2011  19:36:06.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3325.2129 [GMT 2:00]
ausgeführt von:: c:\users\Papa\Desktop\ComboFix.exe
FW: ZoneAlarm Firewall *Disabled* {D17DF357-CFF5-F001-D1C1-FCD21DFE3D5E}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Philips SPC210NC Webcam 
c:\programdata\Microsoft\Windows\Start Menu\Programs\Philips SPC210NC Webcam \Philips VRecord software.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Philips SPC210NC Webcam \Uninstall Philips SPC210NC Webcam.lnk
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-04-28 bis 2011-05-31  ))))))))))))))))))))))))))))))
.
.
2011-05-31 17:44 . 2011-05-31 17:44	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-05-31 17:32 . 2011-05-31 17:33	--------	d-----w-	C:\32788R22FWJFW
2011-05-31 17:29 . 2011-05-09 20:46	6962000	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{26122B31-A2AE-4595-9277-B05D4449B8BC}\mpengine.dll
2011-05-26 20:52 . 2011-05-26 20:52	--------	d-----w-	c:\users\Papa\AppData\Roaming\Malwarebytes
2011-05-26 20:52 . 2010-12-20 16:09	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-26 20:52 . 2011-05-26 20:52	--------	d-----w-	c:\programdata\Malwarebytes
2011-05-26 20:51 . 2011-05-26 20:52	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-05-26 20:51 . 2010-12-20 16:08	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-05-24 14:48 . 2011-05-24 14:48	1138440	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-05-15 17:12 . 2011-05-15 17:12	--------	d-----w-	c:\users\Papa\AppData\Roaming\Amazon
2011-05-15 17:11 . 2011-05-15 17:11	--------	d-----w-	c:\program files\Amazon
2011-05-10 18:51 . 2011-04-07 12:01	2409784	----a-w-	c:\program files\Windows Mail\OESpamFilter.dat
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-30 10:45 . 2011-04-30 10:45	86528	----a-w-	c:\windows\system32\iesysprep.dll
2011-04-30 10:45 . 2011-04-30 10:45	76800	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2011-04-30 10:45 . 2011-04-30 10:45	74752	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2011-04-30 10:45 . 2011-04-30 10:45	48640	----a-w-	c:\windows\system32\mshtmler.dll
2011-04-30 10:45 . 2011-04-30 10:45	161792	----a-w-	c:\windows\system32\msls31.dll
2011-04-30 10:45 . 2011-04-30 10:45	1126912	----a-w-	c:\windows\system32\wininet.dll
2011-04-30 10:45 . 2011-04-30 10:45	74752	----a-w-	c:\windows\system32\iesetup.dll
2011-04-30 10:45 . 2011-04-30 10:45	63488	----a-w-	c:\windows\system32\tdc.ocx
2011-04-30 10:45 . 2011-04-30 10:45	367104	----a-w-	c:\windows\system32\html.iec
2011-04-30 10:45 . 2011-04-30 10:45	23552	----a-w-	c:\windows\system32\licmgr10.dll
2011-04-30 10:45 . 2011-04-30 10:45	152064	----a-w-	c:\windows\system32\wextract.exe
2011-04-30 10:45 . 2011-04-30 10:45	150528	----a-w-	c:\windows\system32\iexpress.exe
2011-04-30 10:45 . 2011-04-30 10:45	1427456	----a-w-	c:\windows\system32\inetcpl.cpl
2011-04-30 10:45 . 2011-04-30 10:45	420864	----a-w-	c:\windows\system32\vbscript.dll
2011-04-30 10:45 . 2011-04-30 10:45	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2011-04-30 10:45 . 2011-04-30 10:45	1797632	----a-w-	c:\windows\system32\jscript9.dll
2011-04-30 10:45 . 2011-04-30 10:45	142848	----a-w-	c:\windows\system32\ieUnatt.exe
2011-04-30 10:45 . 2011-04-30 10:45	11776	----a-w-	c:\windows\system32\mshta.exe
2011-04-30 10:45 . 2011-04-30 10:45	101888	----a-w-	c:\windows\system32\admparse.dll
2011-04-30 10:45 . 2011-04-30 10:45	35840	----a-w-	c:\windows\system32\imgutil.dll
2011-04-30 10:45 . 2011-04-30 10:45	110592	----a-w-	c:\windows\system32\IEAdvpack.dll
2011-04-29 11:24 . 2009-10-27 19:24	4175872	----a-w-	c:\windows\DVAPI32.DLL
2011-04-28 14:07 . 2009-10-27 19:24	8420352	----a-w-	c:\windows\TOBITCLT.DLL
2011-04-14 15:44 . 2009-10-27 19:24	183808	----a-w-	c:\windows\system32\DV4TS.EXE
2011-03-23 15:08 . 2009-10-27 19:24	3560792	----a-w-	c:\windows\uninstic.exe
2011-03-22 19:47 . 2011-03-22 19:47	112	----a-w-	c:\users\Papa\AppData\Roaming\srvblck2.tmp
2011-03-17 18:25 . 2009-03-22 18:58	137656	----a-w-	c:\windows\system32\drivers\avipbb.sys
2011-03-12 21:55 . 2011-04-26 19:37	876032	----a-w-	c:\windows\system32\XpsPrint.dll
2011-03-10 17:03 . 2011-04-20 19:39	1162240	----a-w-	c:\windows\system32\mfc42u.dll
2011-03-10 17:03 . 2011-04-20 19:39	1136640	----a-w-	c:\windows\system32\mfc42.dll
2011-03-03 15:42 . 2011-04-20 19:38	739328	----a-w-	c:\windows\system32\inetcomm.dll
2011-03-03 15:40 . 2011-04-26 19:37	28672	----a-w-	c:\windows\system32\Apphlpdm.dll
2011-03-03 15:40 . 2011-04-26 19:37	173056	----a-w-	c:\windows\apppatch\AcXtrnal.dll
2011-03-03 15:40 . 2011-04-26 19:37	542720	----a-w-	c:\windows\apppatch\AcLayers.dll
2011-03-03 15:40 . 2011-04-26 19:37	458752	----a-w-	c:\windows\apppatch\AcSpecfc.dll
2011-03-03 15:40 . 2011-04-26 19:37	2159616	----a-w-	c:\windows\apppatch\AcGenral.dll
2011-03-03 13:35 . 2011-04-26 19:37	4240384	----a-w-	c:\windows\system32\GameUXLegacyGDFs.dll
2011-03-03 13:25 . 2011-04-20 19:38	2041856	----a-w-	c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-08 178712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"toolbar_eula_launcher"="c:\program files\GoogleEULA\EULALauncher.exe" [2007-02-09 16896]
"RtHDVCpl"="RtHDVCpl.exe" [2008-02-13 4915200]
"Skytel"="Skytel.exe" [2007-11-20 1826816]
"lxdxmon.exe"="c:\program files\Lexmark 3600-4600 Series\lxdxmon.exe" [2008-03-20 668328]
"lxdxamon"="c:\program files\Lexmark 3600-4600 Series\lxdxamon.exe" [2008-03-20 16040]
"BigDogPath"="c:\windows\VM_STI.EXE" [2004-06-09 40960]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2008-01-29 92704]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-29 8530464]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-01-29 88608]
"PlayMovie"="c:\program files\HomeCinema\PlayMovie\PMVService.exe" [2007-09-07 172032]
"UpdatePPShortCut"="c:\program files\HomeCinema\PowerProducer\MUITransfer\MUIStartMenu.exe" [2007-09-13 222504]
"TVEService"="c:\program files\HomeCinema\TV Enhance\TVEService.exe" [2007-10-19 155648]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-01-13 37888]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-05 281768]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2009-03-18 75048]
"RemoteControl"="c:\program files\HomeCinema\PowerDVD\PDVDServ.exe" [2008-07-21 87336]
"LanguageShortcut"="c:\program files\HomeCinema\PowerDVD\Language\Language.exe" [2008-05-14 62760]
"DV4TS.EXE"="c:\windows\system32\DV4TS.EXE" [2011-04-14 183808]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2009-09-05 385024]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-16 141608]
"ContentTransferWMDetector.exe"="c:\program files\Sony\Content Transfer\ContentTransferWMDetector.exe" [2009-11-19 583016]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2011-02-18 1043968]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
TrayMin210.exe.lnk - c:\program files\Philips\Philips SPC210NC Webcam\TrayMin210.exe [2009-2-14 278528]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DSL-Manager.lnk - c:\program files\T-Online\DSL-Manager\DslMgr.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 dsltestSp5;dsltestSp5 NDIS Protocol Driver;c:\windows\system32\Drivers\dsltestSp5.sys [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2009-04-22 9728]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2009-04-22 3072]
R3 IntelDH;IntelDH Driver;c:\windows\system32\Drivers\IntelDH.sys [2008-03-05 5504]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [x]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [x]
R3 vsdatant7;vsdatant7;c:\windows\system32\drivers\vsdatant.win7.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-19 16896]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-12-03 64288]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\HomeCinema\PlayMovie\000.fcl [2007-10-11 41456]
S2 AAV UpdateService;AAV UpdateService;c:\program files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [2008-10-24 128296]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-05-06 136360]
S2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe [2008-02-28 594600]
S2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\system32\spool\DRIVERS\W32X86\3\\lxdxserv.exe [2008-02-28 98984]
S2 TVECapSvc;TVEnhance Background Capture Service (TBCS);c:\program files\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe [2007-10-19 290909]
S2 TVESched;TVEnhance Task Scheduler (TTS));c:\program files\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe [2007-10-19 114779]
S3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2007-08-22 1242976]
S3 avmaudio;AVM Audio;c:\windows\system32\DRIVERS\avmaudio.sys [2009-06-20 101248]
S3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2007-09-21 554496]
S3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2006-11-17 13976]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube Download - c:\users\Papa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Papa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - eBay - eine der größten deutschen Shopping-Websites
TCP: DhcpNameServer = 10.42.0.1
FF - ProfilePath - c:\users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\uras7n3k.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - ZoneAlarm-Sicherheit Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2613550&SearchSource=13
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: JavaString Helper: {E5886C91-CDD7-4832-B32D-0830705A9C60} - c:\users\Papa\AppData\Roaming\5012
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - Ext: JavaString Helper: {E5886C91-CDD7-4832-B32D-0830705A9C60} - c:\users\Papa\AppData\Roaming\5012
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2011-05-31 19:44
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\HomeCinema\PlayMovie\000.fcl"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\HomeCinema\PowerDVD\000.fcl"
.
Zeit der Fertigstellung: 2011-05-31  19:47:17
ComboFix-quarantined-files.txt  2011-05-31 17:47
.
Vor Suchlauf: 14 Verzeichnis(se), 67.145.936.896 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 67.076.825.088 Bytes frei
.
Current=1 Default=1 Failed=0 LastKnownGood=19 Sets=1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19
- - End Of File - - 3BBF93274C1C4289D015790858B9CF79
         
--- --- ---


Alt 31.05.2011, 19:37   #6
markusg
/// Malware-holic
 
Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons - Standard

Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons



welche probleme gibt es noch?
__________________
--> Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons

Alt 01.06.2011, 20:39   #7
weddeltown
 
Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons - Standard

Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons



Hallo,
erstmal wieder Danke! Ich denke, dass keine gravierenden Probleme mehr vorhanden sind. Die Taskleiste und das Feld über "Start" mit Programme, Dokumente, etc. sind noch leer. Bei der Taskleiste habe ich nur das Problem mit dem Desktop Icon, die anderen kann man ja so "reinziehen".
Kann man diese Dinge auch noch beheben?
Gruß

Alt 14.06.2011, 20:37   #8
weddeltown
 
Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons - Standard

Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons



Danke für die Hilfe!
Spende ist unterwegs.
Grüße

Alt 15.06.2011, 10:04   #9
markusg
/// Malware-holic
 
Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons - Standard

Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons



sorry hatte das übersehen, hat sich das mit der schnellstart leiste gegeben?
und thx für die spende
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 16.06.2011, 18:54   #10
weddeltown
 
Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons - Standard

Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons



Konnte das Desktop Icon in der Schnellstartleiste leider noch nicht wieder hinzufügen.

Habe gefunden, dass man eine Datei desktop.scf (siehe unten) auf dem Desktop erstellen und dann das Icon in die Schnellstartleiste ziehen soll. Bei mir geht aber nur das Dokument auf, wenn ich in der Schnellstartleiste auf das Icon drücke. Scheint wohl nur bei XP zu funktionieren.

[Shell]
Command=2
IconFile=explorer.exe,3
[Taskbar]
Command=ToggleDesktop

Alt 16.06.2011, 18:58   #11
markusg
/// Malware-holic
 
Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons - Standard

Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons



du willst ein icon in der schnelstart leiste um den desktop zu erreichen? wie sinnlos ist dass denn... minimiere dein eprogramme und du bist auf dem desktop.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 17.06.2011, 18:05   #12
weddeltown
 
Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons - Standard

Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons



Stimmt, das ist eine Möglichkeit. Aber wenn man mehrere Anwendungen geöffnet hat, ist (war) es schon sehr hilfreich. Ein Klick, und man war auf dem Desktop. Werde jetzt ALT+TAB benutzen....

Antwort

Themen zu Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons
bedeuten, c:\windows\system32\rundll32.exe, defekt, desktop, durchgeführt, fehlermeldung, fehlermeldungen, festplatte, festplatte defekt, gen, hoffe, home, icon, icons, install.exe, komische, nvlddmkm.sys, oldtimer, platte, plug-in, rechner, registry cleaner, runter, sched.exe, schei, schwarzer, schwarzer desktop, searchplugins, security update, sofort, start menu, stehe, suche, trojan.fakems, vista, windows, windows vista, windows vista home



Ähnliche Themen: Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons


  1. Schwarzer Bildschirm danach seltsame Meldung
    Plagegeister aller Art und deren Bekämpfung - 05.09.2015 (15)
  2. Windows 8.1 schwarzer Desktop/keine Icons/keine Taskleiste + kleine andere Probleme
    Plagegeister aller Art und deren Bekämpfung - 02.02.2015 (17)
  3. 3sek normaler desktop danach weiß ohne symbole und taskleiste windows32
    Plagegeister aller Art und deren Bekämpfung - 09.11.2013 (3)
  4. Start_ShowMyComputer (PUM.Hijack.StartMenu) || Fehlermeldung Festplatte defekt || Programme installieren meist nicht möglich
    Log-Analyse und Auswertung - 10.04.2013 (22)
  5. schwarzer Desktop, fehlende Icons und Ordner, delayed writed failed
    Log-Analyse und Auswertung - 10.03.2012 (37)
  6. Win 7 - Gema-Trojaner 2.01 - diverse Schritte bereits umgesetzt - Desktop noch schwarz ohne Icons
    Plagegeister aller Art und deren Bekämpfung - 08.03.2012 (11)
  7. schwarzer Bildschirm, Bibliotheksordner leer, Festplatte angeblich defekt....
    Plagegeister aller Art und deren Bekämpfung - 04.03.2012 (23)
  8. Schwarzer Desktop, Icons versteckt, "delayed write failed..."
    Plagegeister aller Art und deren Bekämpfung - 21.11.2011 (48)
  9. Schwarzer Desktop, Startmenü verschwunden, Meldung "Festplatte Defekt"
    Log-Analyse und Auswertung - 15.11.2011 (46)
  10. TR/Fakealert.OV; Festplatte angeblich defekt; Schwarzer Desktop
    Log-Analyse und Auswertung - 01.07.2011 (16)
  11. Trojaner TR/Kazy.23836.20 und .10, Desktop schwarz, Festplatte Fehlermeldung etc.
    Log-Analyse und Auswertung - 30.06.2011 (24)
  12. Windows XP recovery, Festplatte defekt, schwarzer Desktop
    Plagegeister aller Art und deren Bekämpfung - 12.06.2011 (2)
  13. "Festplatte beschädigt"-Meldungen, schwarzer Desktop, alle Dateien versteckt
    Log-Analyse und Auswertung - 01.06.2011 (12)
  14. Windows Vista Recovery(Festplatte Defekt)Trojaner dazu schwarzer Bildschirm und alle Daten versteckt
    Log-Analyse und Auswertung - 31.05.2011 (7)
  15. Fehlermeldung "Festplatte defekt", "Probleme mit IDE / SATA- Festplatten", Dateien weg
    Log-Analyse und Auswertung - 28.05.2011 (1)
  16. Trjoaner krazy / Festplatte defekt / schwarzer Desktop / keinen Zugriff auf meine Dateien
    Plagegeister aller Art und deren Bekämpfung - 25.05.2011 (3)
  17. Trojaner Vista Desktop leer Festplatte defekt?
    Log-Analyse und Auswertung - 11.05.2011 (3)

Zum Thema Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons - Hallo, ich bin bei der Suche, was die komische Fehlermeldung "Festplatte defekt" zu bedeuten hat, sofort bei Euch gelandet. Mein Rechner hat anscheinend auch die Seuche. Ich hoffe, Ihr könnt - Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons...
Archiv
Du betrachtest: Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.