| |
| |||||||
Log-Analyse und Auswertung: Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne IconsWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
27.05.2011, 20:00
| #1 |
| |  Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons Hallo, ich bin bei der Suche, was die komische Fehlermeldung "Festplatte defekt" zu bedeuten hat, sofort bei Euch gelandet. Mein Rechner hat anscheinend auch die Seuche. Ich hoffe, Ihr könnt mir helfen. Die OTL und Malwarebyte-Scans habe ich durchgeführt und beigefügt. Was mir noch aufgefallen ist: Wenn man die vielen Fehlermeldungen stehen lässt, scheint der Rechner nicht von allein runter zu fahren. Betriebssystem: Windows Vista Home Edition Grüße OTL Logfile: Code:
ATTFilter OTL logfile created on: 27.05.2011 20:47:09 - Run 2 OTL by OldTimer - Version 3.2.23.0 Folder = I:\ Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,25 Gb Total Physical Memory | 1,66 Gb Available Physical Memory | 51,09% Memory free 6,69 Gb Paging File | 5,37 Gb Available in Paging File | 80,30% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 444,18 Gb Total Space | 52,57 Gb Free Space | 11,84% Space Free | Partition Type: NTFS Drive D: | 21,57 Gb Total Space | 13,91 Gb Free Space | 64,50% Space Free | Partition Type: FAT32 Drive I: | 1,96 Gb Total Space | 1,95 Gb Free Space | 99,59% Space Free | Partition Type: FAT Computer Name: PAPA-PC | User Name: Papa | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - I:\OTL.exe (OldTimer Tools) PRC - C:\ProgramData\ceeiLjmUBGBADu.exe (Microsoft Corporation) PRC - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited) PRC - C:\Programme\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft Limited) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Windows\System32\DV4TS.EXE (Tobit.Software) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD) PRC - C:\Programme\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\Programme\Winamp\winampa.exe (Nullsoft, Inc.) PRC - C:\Programme\Sony\Content Transfer\ContentTransferWMDetector.exe (Sony Corporation) PRC - C:\Programme\FreePDF_XP\fpassist.exe (shbox.de) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\conime.exe (Microsoft Corporation) PRC - C:\Programme\CyberLink\Shared Files\brs.exe (cyberlink) PRC - C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe () PRC - C:\Programme\HomeCinema\PowerDVD\PDVDServ.exe (Cyberlink Corp.) PRC - C:\Programme\Lexmark 3600-4600 Series\lxdxmsdmon.exe () PRC - C:\Programme\Lexmark 3600-4600 Series\lxdxmon.exe () PRC - C:\Windows\System32\lxdxcoms.exe ( ) PRC - C:\Windows\System32\spool\drivers\w32x86\3\lxdxserv.exe (Lexmark International, Inc.) PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation) PRC - C:\Programme\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe () PRC - C:\Programme\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe () PRC - C:\Programme\HomeCinema\TV Enhance\TVEService.exe (CyberLink Corp.) PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) PRC - C:\Programme\HomeCinema\PlayMovie\PMVService.exe (CyberLink Corp.) PRC - C:\Programme\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) PRC - C:\Programme\Common Files\Ahead\Lib\NMIndexStoreSvr.exe (Nero AG) PRC - C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation) PRC - C:\Programme\Philips\Philips SPC210NC Webcam\TrayMin210.exe () PRC - C:\Windows\VM_STI.EXE (BIGDOG) PRC - C:\Programme\Common Files\X10\Common\X10nets.exe (X10) ========== Modules (SafeList) ========== MOD - I:\OTL.exe (OldTimer Tools) MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (Lavasoft Ad-Aware Service) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited) SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (vsmon) -- C:\Windows\System32\ZoneLabs\vsmon.exe (Check Point Software Technologies LTD) SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia) SRV - (AAV UpdateService) -- C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe () SRV - (lxdx_device) -- C:\Windows\System32\lxdxcoms.exe ( ) SRV - (lxdxCATSCustConnectService) -- C:\Windows\System32\spool\DRIVERS\W32X86\3\\lxdxserv.exe () SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation) SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation) SRV - (TVECapSvc) TVEnhance Background Capture Service (TBCS) -- C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe () SRV - (TVESched) TVEnhance Task Scheduler (TTS)) -- C:\Program Files\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe () SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) SRV - (x10nets) -- C:\Programme\Common Files\X10\Common\X10nets.exe (X10) ========== Driver Services (SafeList) ========== DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (Lavasoft Kernexplorer) -- C:\Programme\Lavasoft\Ad-Aware\kernexplorer.sys () DRV - (Lbd) -- C:\Windows\system32\DRIVERS\Lbd.sys (Lavasoft AB) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (Vsdatant) -- C:\Windows\System32\drivers\vsdatant.sys (Check Point Software Technologies LTD) DRV - (avmaudio) -- C:\Windows\System32\drivers\avmaudio.sys (AVM Berlin) DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (epmntdrv) -- C:\Windows\System32\epmntdrv.sys () DRV - (EuGdiDrv) -- C:\Windows\System32\EuGdiDrv.sys () DRV - ({95808DC4-FA4A-4C74-92FE-5B863F82066B}) -- C:\Programme\HomeCinema\PowerDVD\000.fcl (CyberLink Corp.) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (IntelDH) -- C:\Windows\System32\drivers\IntelDH.sys (Intel Corporation) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (WSDPrintDevice) -- C:\Windows\System32\drivers\WSDPrint.sys (Microsoft Corporation) DRV - ({49DE1C67-83F8-4102-99E0-C16DCC7EEC796}) -- C:\Programme\HomeCinema\PlayMovie\000.fcl (Cyberlink Corp.) DRV - (netr28u) -- C:\Windows\System32\drivers\netr28u.sys (Ralink Technology Corp.) DRV - (3xHybrid) -- C:\Windows\System32\drivers\3xHybrid.sys (NXP Semiconductors Germany GmbH) DRV - (e1express) Intel(R) -- C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation) DRV - (XUIF) -- C:\Windows\System32\drivers\x10ufx2.sys (X10 Wireless Technology, Inc.) DRV - (X10Hid) -- C:\Windows\System32\drivers\x10hid.sys (X10 Wireless Technology, Inc.) DRV - (ZSMC301b) -- C:\Windows\System32\drivers\usbVM31b.sys (VM) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "ZoneAlarm-Sicherheit Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.selectedEngine: "ZoneAlarm-Sicherheit Customized Web Search" FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2613550&SearchSource=13" FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: {E5886C91-CDD7-4832-B32D-0830705A9C60}:1.0 FF - HKLM\software\mozilla\Mozilla Firefox 3.5.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.04.28 20:41:10 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.04.28 20:41:10 | 000,000,000 | ---D | M] [2009.10.17 16:36:23 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Papa\AppData\Roaming\mozilla\Extensions [2011.05.27 20:21:27 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Papa\AppData\Roaming\mozilla\Firefox\Profiles\uras7n3k.default\extensions [2011.01.28 17:00:09 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Papa\AppData\Roaming\mozilla\Firefox\Profiles\uras7n3k.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.10.14 21:33:48 | 000,000,000 | -H-D | M] ("DVDVideoSoft Menu") -- C:\Users\Papa\AppData\Roaming\mozilla\Firefox\Profiles\uras7n3k.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011.01.17 15:41:40 | 000,000,943 | -H-- | M] () -- C:\Users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\uras7n3k.default\searchplugins\conduit.xml [2011.03.08 18:48:06 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.05.08 10:50:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.09.12 19:46:56 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.11.13 15:22:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.01.22 18:17:00 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.03.08 18:48:06 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2010.02.27 20:45:58 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} [2009.11.09 20:05:30 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} [2010.04.01 20:00:19 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} [2010.05.08 10:50:36 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.09.12 19:46:56 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010.11.13 15:22:59 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.01.22 18:17:00 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.03.08 18:48:06 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011.03.22 22:01:18 | 000,000,000 | -H-D | M] (Java String Helper) -- C:\USERS\PAPA\APPDATA\ROAMING\5012 [2011.02.02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll [2010.01.14 00:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npwachk.dll [2011.04.28 20:41:04 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2011.04.28 20:41:04 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2011.04.28 20:41:04 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2011.04.28 20:41:05 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2011.04.28 20:41:05 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found. O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No CLSID value found. O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [BDRegion] C:\Programme\CyberLink\Shared Files\brs.exe (cyberlink) O4 - HKLM..\Run: [BigDogPath] C:\Windows\VM_STI.EXE (BIGDOG) O4 - HKLM..\Run: [ContentTransferWMDetector.exe] C:\Programme\Sony\Content Transfer\ContentTransferWMDetector.exe (Sony Corporation) O4 - HKLM..\Run: [DV4TS.EXE] C:\Windows\System32\DV4TS.EXE (Tobit.Software) O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de) O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation) O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files\HomeCinema\PowerDVD\Language\Language.exe () O4 - HKLM..\Run: [lxdxamon] C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe () O4 - HKLM..\Run: [lxdxmon.exe] C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe () O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvSvc] C:\Windows\System32\nvsvc.dll (NVIDIA Corporation) O4 - HKLM..\Run: [PlayMovie] C:\Program Files\HomeCinema\PlayMovie\PMVService.exe (CyberLink Corp.) O4 - HKLM..\Run: [RemoteControl] C:\Program Files\HomeCinema\PowerDVD\PDVDServ.exe (Cyberlink Corp.) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [toolbar_eula_launcher] C:\Programme\GoogleEULA\EULALauncher.exe ( ) O4 - HKLM..\Run: [TVEService] C:\Program Files\HomeCinema\TV Enhance\TVEService.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files\HomeCinema\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [Windows Mobile-based device management] C:\Windows\WindowsMobile\wmdSync.exe (Microsoft Corporation) O4 - HKLM..\Run: [ZoneAlarm Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe (Check Point Software Technologies LTD) O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKCU..\Run: [ceeiLjmUBGBADu] C:\ProgramData\ceeiLjmUBGBADu.exe (Microsoft Corporation) O8 - Extra context menu item: Free YouTube Download - C:\Users\Papa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Papa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab (Java Plug-in 1.6.0_16) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.42.0.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (lsdelete) - C:\Windows\System32\lsdelete.exe () O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906) ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447) ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - File not found NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.05.27 18:29:19 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD [2011.05.26 22:52:14 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Roaming\Malwarebytes [2011.05.26 22:52:04 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys [2011.05.26 22:52:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.05.26 22:52:02 | 000,000,000 | -H-D | C] -- C:\ProgramData\Malwarebytes [2011.05.26 22:51:59 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.05.26 22:51:59 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2011.05.26 21:34:05 | 000,365,056 | -H-- | C] (Microsoft Corporation) -- C:\ProgramData\34660088.exe [2011.05.26 21:24:02 | 000,473,600 | -H-- | C] (Microsoft Corporation) -- C:\ProgramData\ceeiLjmUBGBADu.exe [2011.05.15 19:12:22 | 000,000,000 | -H-D | C] -- C:\Users\Papa\AppData\Roaming\Amazon [2011.05.15 19:11:07 | 000,000,000 | ---D | C] -- C:\Programme\Amazon [2011.05.15 19:11:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Amazon [2011.05.15 12:13:48 | 000,000,000 | -H-D | C] -- C:\Users\Papa\Documents\Logopak [2011.03.22 21:47:08 | 000,236,496 | -H-- | C] (Adobe Systems, Incorporated) -- C:\Users\Papa\AppData\Roaming\AcroIEHelpe.dll [2009.02.13 23:07:56 | 000,438,272 | ---- | C] ( ) -- C:\Windows\System32\LXDXhcp.dll [2009.02.13 23:07:56 | 000,364,544 | ---- | C] ( ) -- C:\Windows\System32\lxdxinpa.dll [2009.02.13 23:07:55 | 001,105,920 | ---- | C] ( ) -- C:\Windows\System32\lxdxserv.dll [2009.02.13 23:07:55 | 000,843,776 | ---- | C] ( ) -- C:\Windows\System32\lxdxusb1.dll [2009.02.13 23:07:55 | 000,339,968 | ---- | C] ( ) -- C:\Windows\System32\lxdxiesc.dll [2009.02.13 23:07:55 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\lxdxprox.dll [2009.02.13 23:07:54 | 000,647,168 | ---- | C] ( ) -- C:\Windows\System32\lxdxpmui.dll [2009.02.13 23:07:54 | 000,569,344 | ---- | C] ( ) -- C:\Windows\System32\lxdxlmpm.dll [2009.02.13 23:07:53 | 000,663,552 | ---- | C] ( ) -- C:\Windows\System32\lxdxhbn3.dll [2009.02.13 23:07:53 | 000,320,168 | ---- | C] ( ) -- C:\Windows\System32\lxdxih.exe [2009.02.13 23:07:52 | 000,851,968 | ---- | C] ( ) -- C:\Windows\System32\lxdxcomc.dll [2009.02.13 23:07:52 | 000,594,600 | ---- | C] ( ) -- C:\Windows\System32\lxdxcoms.exe [2009.02.13 23:07:52 | 000,376,832 | ---- | C] ( ) -- C:\Windows\System32\lxdxcomm.dll [2009.02.13 23:07:52 | 000,365,224 | ---- | C] ( ) -- C:\Windows\System32\lxdxcfg.exe [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [1 C:\Users\Papa\AppData\Roaming\*.tmp files -> C:\Users\Papa\AppData\Roaming\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.05.27 20:28:53 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.05.27 20:28:53 | 000,003,568 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.05.27 18:36:17 | 000,638,510 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.05.27 18:36:17 | 000,604,126 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.05.27 18:36:17 | 000,130,462 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.05.27 18:36:17 | 000,107,562 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.05.27 18:28:52 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.05.27 18:28:50 | 3485,696,000 | -HS- | M] () -- C:\hiberfil.sys [2011.05.26 21:10:37 | 000,000,064 | ---- | M] () -- C:\Windows\System32\rp_stats.dat [2011.05.26 21:10:37 | 000,000,044 | ---- | M] () -- C:\Windows\System32\rp_rules.dat [2011.05.24 18:30:48 | 000,002,615 | -H-- | M] () -- C:\Users\Papa\Desktop\FlatOut2.lnk [2011.05.15 11:41:33 | 000,000,563 | ---- | M] () -- C:\Windows\Tobit.ini [2011.04.30 12:45:21 | 000,008,798 | ---- | M] () -- C:\Windows\System32\icrav03.rat [2011.04.30 12:45:21 | 000,001,988 | ---- | M] () -- C:\Windows\System32\ticrf.rat [2011.04.30 12:45:13 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf [2011.04.29 13:24:35 | 004,175,872 | ---- | M] (Tobit.Software) -- C:\Windows\DVAPI32.DLL [2011.04.28 16:07:37 | 008,420,352 | ---- | M] () -- C:\Windows\TOBITCLT.DLL [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [3 C:\ProgramData\*.tmp files -> C:\ProgramData\*.tmp -> ] [1 C:\Users\Papa\AppData\Roaming\*.tmp files -> C:\Users\Papa\AppData\Roaming\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.05.08 12:43:56 | 000,000,064 | ---- | C] () -- C:\Windows\System32\rp_stats.dat [2011.05.08 12:43:56 | 000,000,044 | ---- | C] () -- C:\Windows\System32\rp_rules.dat [2011.04.30 12:45:13 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf [2011.01.23 16:53:31 | 000,016,432 | ---- | C] () -- C:\Windows\System32\lsdelete.exe [2011.01.16 19:47:05 | 000,000,056 | ---- | C] () -- C:\Windows\cryavitowmv.ini [2011.01.16 16:06:16 | 000,000,005 | ---- | C] () -- C:\Windows\System32\SySavitowmv.dat [2010.10.23 13:31:52 | 000,152,064 | ---- | C] () -- C:\Windows\System32\unrar.dll [2010.06.18 13:34:43 | 000,007,592 | -H-- | C] () -- C:\Users\Papa\AppData\Local\d3d9caps.dat [2010.01.31 20:44:34 | 000,116,224 | ---- | C] () -- C:\Windows\System32\redmonnt.dll [2010.01.31 20:44:34 | 000,045,056 | ---- | C] () -- C:\Windows\System32\unredmon.exe [2009.10.27 21:25:04 | 000,114,688 | ---- | C] () -- C:\Windows\DVGRF.DLL [2009.10.27 21:25:04 | 000,086,016 | ---- | C] () -- C:\Windows\System32\IMGMSGMO.dll [2009.10.27 21:24:55 | 008,420,352 | ---- | C] () -- C:\Windows\TOBITCLT.DLL [2009.10.27 21:24:55 | 000,000,023 | ---- | C] () -- C:\Windows\AVFD.INI [2009.10.27 21:24:31 | 000,000,563 | ---- | C] () -- C:\Windows\Tobit.ini [2009.09.25 18:23:45 | 001,663,488 | ---- | C] () -- C:\Windows\System32\BootMan.exe [2009.09.25 18:23:45 | 000,086,408 | ---- | C] () -- C:\Windows\System32\setupempdrv03.exe [2009.09.25 18:23:45 | 000,014,848 | ---- | C] () -- C:\Windows\System32\EuEpmGdi.dll [2009.09.25 18:23:45 | 000,009,728 | ---- | C] () -- C:\Windows\System32\epmntdrv.sys [2009.09.25 18:23:45 | 000,003,072 | ---- | C] () -- C:\Windows\System32\EuGdiDrv.sys [2009.09.18 20:02:04 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.09.18 20:02:04 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2009.05.05 17:52:46 | 000,000,000 | -H-- | C] () -- C:\Users\Papa\AppData\Roaming\Default.PLS [2009.02.22 13:26:25 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2009.02.16 21:19:24 | 000,032,256 | -H-- | C] () -- C:\Users\Papa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.02.15 19:06:03 | 000,000,000 | -H-- | C] () -- C:\Users\Papa\AppData\Roaming\wklnhst.dat [2009.02.13 23:11:09 | 000,360,448 | ---- | C] () -- C:\Windows\System32\lxdxcoin.dll [2009.02.13 23:10:37 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxdxvs.dll [2009.02.13 23:09:41 | 000,782,336 | ---- | C] () -- C:\Windows\System32\lxdxdrs.dll [2009.02.13 23:09:41 | 000,081,920 | ---- | C] () -- C:\Windows\System32\lxdxcaps.dll [2009.02.13 23:09:41 | 000,069,632 | ---- | C] () -- C:\Windows\System32\lxdxcnv4.dll [2009.02.13 23:08:16 | 000,000,044 | ---- | C] () -- C:\Windows\System32\lxdxrwrd.ini [2009.02.13 23:07:56 | 000,348,160 | ---- | C] () -- C:\Windows\System32\LXDXinst.dll [2009.02.13 23:07:53 | 000,208,896 | ---- | C] () -- C:\Windows\System32\lxdxgrd.dll [2009.02.13 21:56:24 | 000,000,092 | -H-- | C] () -- C:\Users\Papa\AppData\Local\fusioncache.dat [2007.12.20 11:20:42 | 000,000,069 | ---- | C] () -- C:\Windows\NeroDigital.ini [2007.12.19 16:44:01 | 000,127,184 | ---- | C] () -- C:\Windows\Unwise.exe [2007.10.25 13:29:33 | 000,009,824 | ---- | C] () -- C:\Windows\System32\34CoInstaller.dll [2006.11.02 17:33:31 | 000,638,510 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2006.11.02 17:33:31 | 000,130,462 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 14:47:37 | 000,316,056 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006.11.02 12:33:01 | 000,604,126 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 12:33:01 | 000,107,562 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat ========== LOP Check ========== [2011.03.22 22:01:18 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\5012 [2011.05.15 19:12:22 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\Amazon [2011.01.23 19:34:39 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\CheckPoint [2011.01.08 01:21:45 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\DVDVideoSoft [2011.01.08 01:21:57 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\DVDVideoSoftIEHelpers [2011.01.16 20:20:01 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\GetRightToGo [2009.02.13 23:29:33 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\GHISLER [2010.07.06 20:43:27 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\gtk-2.0 [2011.01.16 16:15:39 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\HandBrake [2009.02.22 21:02:38 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\IrfanView [2011.03.22 21:46:57 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\kock [2009.02.13 23:52:04 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\Lexmark Productivity Studio [2010.06.24 20:17:24 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\Nokia [2009.02.14 21:54:13 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\OpenOffice.org [2010.06.24 20:17:22 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\PC Suite [2009.09.01 20:57:56 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\T-Online [2010.01.03 15:42:26 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\Template [2011.03.26 11:43:34 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\Tobit [2011.03.26 12:03:49 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\UAs [2011.03.26 12:06:05 | 000,000,000 | -H-D | M] -- C:\Users\Papa\AppData\Roaming\xmldm [2011.05.27 18:27:44 | 000,032,554 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2009.02.13 21:56:22 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN [2009.09.21 22:15:42 | 000,000,000 | -HSD | M] -- C:\Boot [2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2009.02.13 21:52:43 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2007.12.19 14:08:39 | 000,000,000 | -H-D | M] -- C:\Intel [2011.03.27 20:10:35 | 000,000,000 | -H-D | M] -- C:\Logopak [2009.02.13 23:11:59 | 000,000,000 | -H-D | M] -- C:\logs [2011.01.16 20:03:05 | 000,000,000 | -H-D | M] -- C:\My Video [2009.06.05 21:06:31 | 000,000,000 | -H-D | M] -- C:\MyWorks [2009.03.12 17:34:56 | 000,000,000 | -H-D | M] -- C:\OETINGER [2009.02.20 19:31:35 | 000,000,000 | ---D | M] -- C:\PerfLogs [2009.03.22 17:32:54 | 000,000,000 | -H-D | M] -- C:\Phenomedia AG [2011.05.26 22:55:07 | 000,000,000 | R--D | M] -- C:\Programme [2011.05.26 22:52:02 | 000,000,000 | -H-D | M] -- C:\ProgramData [2009.02.13 21:52:43 | 000,000,000 | -HSD | M] -- C:\Programme [2011.05.27 20:48:21 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2010.10.21 20:50:55 | 000,000,000 | -H-D | M] -- C:\TEMP [2010.01.19 17:40:15 | 000,000,000 | -H-D | M] -- C:\totalcmd [2009.08.16 21:07:36 | 000,000,000 | R--D | M] -- C:\Users [2011.04.20 21:40:35 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < MD5 for: EXPLORER.EXE > [2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe [2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe [2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe [2007.12.19 14:02:36 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe [2007.12.19 14:02:36 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe [2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe [2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe [2008.01.19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe < MD5 for: REGEDIT.EXE > [2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe [2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe [2006.11.02 11:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_f1f7f368deed95c3\regedit.exe < MD5 for: USERINIT.EXE > [2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe [2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe [2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe < MD5 for: WININIT.EXE > [2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe [2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe [2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe < MD5 for: WINLOGON.EXE > [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe [2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe [2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe [2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-27 15:58:27 < End of report > OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 27.05.2011 18:35:32 - Run 1
OTL by OldTimer - Version 3.2.23.0 Folder = I:\
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,25 Gb Total Physical Memory | 1,91 Gb Available Physical Memory | 58,91% Memory free
6,68 Gb Paging File | 5,43 Gb Available in Paging File | 81,20% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 444,18 Gb Total Space | 52,63 Gb Free Space | 11,85% Space Free | Partition Type: NTFS
Drive D: | 21,57 Gb Total Space | 13,91 Gb Free Space | 64,50% Space Free | Partition Type: FAT32
Drive I: | 1,96 Gb Total Space | 1,95 Gb Free Space | 99,60% Space Free | Partition Type: FAT
Computer Name: PAPA-PC | User Name: Papa | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{5EC22E80-0293-44E0-AC96-CB5BC4F80814}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{80F850DC-E6CD-400D-AA74-8736302C9DE6}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{8C16A2C8-EE5B-4EDD-92BF-09EC38922D1A}" = lport=2869 | protocol=6 | dir=in | app=system |
"{A6851F42-E12A-49E0-B7EB-2DEAFB8B66BB}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{011961B7-6FBD-464D-AEF3-FEF8A581C7D2}" = protocol=17 | dir=in | app=c:\users\papa\appdata\local\apps\2.0\oxoaa3r7.x0r\50voyte8.7km\frit..tion_f8d772dfbb3f7453_0002.0001_0db5bf169ed5c0c1\fritzbox-usb-fernanschluss.exe |
"{171FA388-3ECB-4883-87D5-09AE437A1D74}" = protocol=6 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{2381DC59-A92D-407E-89A9-51DB20D57508}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{293F2135-7BDA-4757-A5E6-51D2DFB97C1F}" = protocol=6 | dir=in | app=c:\users\papa\appdata\local\apps\2.0\oxoaa3r7.x0r\50voyte8.7km\frit..tion_f8d772dfbb3f7453_0002.0001_0db5bf169ed5c0c1\fritzbox-usb-fernanschluss.exe |
"{2E154FDF-F672-46EA-8D24-5B38982CB782}" = dir=in | app=c:\program files\homecinema\makedisc\makedisc.exe |
"{2F59AC89-EDD5-45AE-BB19-1FE4AB27597B}" = protocol=17 | dir=in | app=c:\program files\lexmark 3600-4600 series\frun.exe |
"{34A08932-3034-4AF1-9FCF-F92F5F1496A1}" = protocol=6 | dir=in | app=c:\program files\lexmark 3600-4600 series\lxdxmon.exe |
"{3831ECAC-409B-46B7-8A72-26F0E1EE3D70}" = dir=in | app=c:\program files\homecinema\playmovie\playmovie.exe |
"{430505F4-5C6C-4E24-85E1-1668203DBDB2}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdxtime.exe |
"{4784A495-0C91-40B0-BBED-CB8482CA52CC}" = protocol=6 | dir=in | app=c:\windows\system32\lxdxcoms.exe |
"{488853FA-2BDF-4399-8F04-621777C1258F}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{4CE35CFD-E885-4580-B448-0B7A3D4ED3D2}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdxtime.exe |
"{56CF16AE-63AE-401A-B991-D7AADA7CD602}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{5E50D890-6062-4332-8C7D-DDBE00432894}" = protocol=17 | dir=in | app=c:\windows\system32\lxdxcoms.exe |
"{62BFAB41-46F9-4791-B0AE-C04B658612CD}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdxpswx.exe |
"{64652769-BF67-4B69-A3DD-7FBB73ED84E6}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdxjswx.exe |
"{6C9D0670-5EEC-46F5-97C0-BD2D3C6DD2BD}" = protocol=6 | dir=in | app=c:\program files\lexmark 3600-4600 series\lxdxamon.exe |
"{6EC4452F-E9EA-4316-956F-D9EF1A8FF1C8}" = protocol=17 | dir=in | app=c:\program files\lexmark 3600-4600 series\lxdxamon.exe |
"{7CC91D09-5C5A-4532-9E6B-716651EC9D8F}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{7D4D5B8F-6652-45BF-96DF-DBD7F44F46C0}" = protocol=17 | dir=in | app=c:\windows\system32\zonelabs\vsmon.exe |
"{90E2670F-DE2C-488A-BBB2-5981F73CAEFC}" = protocol=6 | dir=in | app=c:\program files\lexmark 3600-4600 series\frun.exe |
"{95D75C42-D075-4B3F-B2D1-66150A000304}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{A10690A3-9E5F-493E-99A1-2C4EBD19C48E}" = protocol=17 | dir=in | app=c:\windows\system32\lxdxcfg.exe |
"{B095F7B7-A711-4C11-B4F3-E833264DDD73}" = protocol=17 | dir=in | app=c:\program files\lexmark 3600-4600 series\lxdxmon.exe |
"{BA192D85-B974-4532-BF0A-C164F3AB81A2}" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdxjswx.exe |
"{BB6659CA-BCAE-49BF-821E-48F6825A3A66}" = dir=in | app=c:\program files\homecinema\powerdvd\powerdvd.exe |
"{D9BA0D3D-4C03-4B90-9375-B380C9F4C071}" = dir=in | app=c:\program files\homecinema\tv enhance\tvenhance.exe |
"{E0297CAE-8DA1-4289-BAA6-E437BEBDC542}" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdxpswx.exe |
"{E40CB1B4-CCCE-4EFF-A0A3-A83E274DA87F}" = dir=in | app=c:\program files\homecinema\playmovie\pmvservice.exe |
"{F37CFA66-E0B5-49EE-9793-52F58645381B}" = dir=in | app=c:\program files\homecinema\tv enhance\tveservice.exe |
"{F863DC61-C4BB-4840-8F65-1FCCA7BDDB67}" = protocol=6 | dir=in | app=c:\windows\system32\lxdxcfg.exe |
"TCP Query User{0B2323EA-52DF-41B7-9A64-A715C345544D}C:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe |
"TCP Query User{51969177-B94D-453C-B6E5-00AF56E99D9C}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{5605F5CB-686D-43A7-BF80-F9DA08B400B6}C:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\extra1\bin\settlershok.exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\extra1\bin\settlershok.exe |
"TCP Query User{BBBDFB24-C414-49D6-A379-1D362401C764}C:\program files\lexmark 3600-4600 series\lxdxlscn.exe" = protocol=6 | dir=in | app=c:\program files\lexmark 3600-4600 series\lxdxlscn.exe |
"UDP Query User{136E9409-D69A-47DA-A1AB-719242137ED7}C:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\extra1\bin\settlershok.exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\extra1\bin\settlershok.exe |
"UDP Query User{4F3F1D3F-39FA-4F5E-A37E-E74966A3BAF3}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{61F91B3C-D96B-40F1-A9F9-C2DF4C38D7B1}C:\program files\lexmark 3600-4600 series\lxdxlscn.exe" = protocol=17 | dir=in | app=c:\program files\lexmark 3600-4600 series\lxdxlscn.exe |
"UDP Query User{85818B43-EB53-4145-A541-9AEE6B969342}C:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\blue byte\die siedler - das erbe der könige - gold edition\bin\settlershok.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{089DD780-DB3F-4CDB-A0C2-111360247298}" = PC Connectivity Solution
"{0CB9668D-F979-4F31-B8B8-67FE90F929F8}" = Bonjour
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{202BACA0-AA91-11D4-A5EE-004095501894}" = Wendy
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java(TM) 6 Update 24
"{26A24AE4-039D-4CA4-87B4-2F83216016F0}" = Java(TM) 6 Update 16
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{32E00E5E-22B1-4D5A-9DC2-CD75E087A5E6}" = Steuer-Spar-Erklärung 2009
"{38D95956-E92C-4473-904B-CD877EA04410}" = Philips SPC210NC Webcam
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = CyberLink PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{7655E113-C306-11D9-A373-0050BAE317E1}" = MCE Software Encoder 1.1
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{78C81F94-6510-4EDF-8397-2D0932608F35}_is1" = TOPP Vorlagen-Druckstudio (3560)
"{7E641E46-81DB-4D1D-906A-48342523051C}" = FlatOut2
"{81AB1374-098A-43CB-BE57-31CEB5EB1031}" = Nero 7 Essentials
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{85991ED2-010C-4930-96FA-52F43C2CE98A}" = Apple Mobile Device Support
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel(R) Matrix Storage Manager
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D7E5329-5751-435B-B585-0EFF51783A20}" = NWZ-E350 WALKMAN Guide
"{9F5FD796-86F0-4360-85F8-D54C0F5411EB}" = Steuer-Spar-Erklärung 2011
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A14C40E7-F7E5-498D-B8BD-A3EAE942EED0}" = LEGO® Indiana Jones™
"{A450831D-25F6-4F42-9662-D000B25E0D82}" = Play Movie
"{AC76BA86-7AD7-1031-7B44-A81000000003}" = Adobe Reader 8.1.1 - Deutsch
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{B145EC69-66F5-11D8-9D75-000129760D75}" = MakeDisc
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{B82157D3-6D31-4650-93B4-FC39BB08D6CE}" = AAVUpdateManager
"{BBBF4CFE-9D26-4D93-A869-B2B021B3CA85}" = Intel(R) PRO Network Connections 12.2.41.0
"{C1E11C46-E6EB-4BD2-9ADF-2A98ACBEB216}" = iTunes
"{C5FC10F2-F93D-4083-8303-EA6327FF94D3}" = Lars der kleine Eisbär
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFADE4AF-C0CF-4A04-A776-741318F1658F}" = Content Transfer
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D8E1DFEE-622B-46BA-AEFF-AB7E541C0B21}" = Steuer-Spar-Erklärung 2010
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E08DE897-B6AF-4DFF-9E90-131E80C876B4}" = DIE SIEDLER - Das Erbe der Könige - Gold Edition
"{E1180142-3B31-4DCC-9D27-7AC2D37662BF}" = LightScribe 1.4.124.1
"{E4C891D6-6844-41B8-86E8-633CACCC644F}" = TV Enhance
"{ED1390DC-6910-4C77-97E2-579CAFE82F5B}" = Moorhuhn 4 Teile
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Ad-Aware" = Ad-Aware
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"CDex" = CDex extraction audio
"Cossacks : Back To War" = Cossacks - Back To War
"David Client" = David Client
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 4.0 Home Edition
"Flight Simulator 9.0" = Microsoft Flight Simulator 2004 - Das Jahrhundert der Luftfahrt
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.2
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.1
"Free Studio_is1" = Free Studio version 5.0.3
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2
"FreePDF_XP" = FreePDF (Remove only)
"GPL Ghostscript 8.70" = GPL Ghostscript 8.70
"InstallShield_{A14C40E7-F7E5-498D-B8BD-A3EAE942EED0}" = LEGO® Indiana Jones™
"IrfanView" = IrfanView (remove only)
"Lexmark 3600-4600 Series" = Lexmark 3600-4600 Series
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.5.16)" = Mozilla Firefox (3.5.16)
"NVIDIA Drivers" = NVIDIA Drivers
"PROSetDX" = Intel(R) PRO Network Connections 12.2.41.0
"ProviStars - Die Log-O-Matic" = ProviStars - Die Log-O-Matic
"ratDVD" = ratDVD 0.78.1444
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"Totalcmd" = Total Commander (Remove or Repair)
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.5
"WBFS Manager 3.0" = WBFS Manager 3.0
"Winamp" = Winamp
"WinGimp-2.0_is1" = GIMP 2.6.9
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"Wise Registry Cleaner_is1" = Wise Registry Cleaner Free 5.33
"X10Hardware" = X10 Hardware(TM)
"ZoneAlarm" = ZoneAlarm
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"f6791b188d8f3ff8" = AVM FRITZ!Box USB-Fernanschluss
"Winamp Detect" = Winamp Erkennungs-Plug-in
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 07.09.2010 12:00:10 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 07.09.2010 12:00:10 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 07.09.2010 13:30:52 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 07.09.2010 13:30:52 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 08.09.2010 13:07:48 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 08.09.2010 13:07:49 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 09.09.2010 13:08:31 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 09.09.2010 13:08:31 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 10.09.2010 10:31:49 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 10.09.2010 10:31:49 | Computer Name = Papa-PC | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
[ Media Center Events ]
Error - 28.02.2009 10:51:59 | Computer Name = Papa-PC | Source = ehRecvr | ID = 3
Description =
Error - 28.02.2009 11:48:01 | Computer Name = Papa-PC | Source = ehRecvr | ID = 3
Description =
Error - 28.02.2009 12:07:46 | Computer Name = Papa-PC | Source = ehRecvr | ID = 4
Description =
Error - 18.05.2011 14:46:50 | Computer Name = Papa-PC | Source = ehSched | ID = 5
Description = CResourceMgr::GetEhepgdat Error GetEhepgdatDispatcher 0x80080005
[ System Events ]
Error - 18.05.2011 14:46:50 | Computer Name = Papa-PC | Source = DCOM | ID = 10010
Description =
Error - 24.05.2011 10:37:32 | Computer Name = Papa-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 23.05.2011 um 19:08:48 unerwartet heruntergefahren.
Error - 26.05.2011 15:05:15 | Computer Name = Papa-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 24.05.2011 um 18:47:27 unerwartet heruntergefahren.
Error - 26.05.2011 15:38:17 | Computer Name = Papa-PC | Source = Service Control Manager | ID = 7022
Description =
Error - 26.05.2011 16:23:41 | Computer Name = Papa-PC | Source = Service Control Manager | ID = 7022
Description =
Error - 26.05.2011 16:52:07 | Computer Name = Papa-PC | Source = Service Control Manager | ID = 7022
Description =
Error - 26.05.2011 17:16:09 | Computer Name = Papa-PC | Source = RasMan | ID = 20033
Description = Die RAS-Verbindungsverwaltung konnte nicht gestartet werden, da keine
Registrierung bei der lokalen Sicherheitsinstanz ausgeführt werden konnte. Führen
Sie einen Neustart der RAS-Verbindungsverwaltung aus. Falls das Problem weiterhin
besteht, wenden Sie sich an den Systemadministrator. Unzulässige Funktion.
Error - 27.05.2011 11:40:49 | Computer Name = Papa-PC | Source = Service Control Manager | ID = 7022
Description =
Error - 27.05.2011 12:11:26 | Computer Name = Papa-PC | Source = Service Control Manager | ID = 7022
Description =
Error - 27.05.2011 12:35:17 | Computer Name = Papa-PC | Source = Service Control Manager | ID = 7022
Description =
< End of report >
Malwarebytes' Anti-Malware 1.50.1.1100 Malwarebytes : Free anti-malware, anti-virus and spyware removal download Datenbank Version: 6693 Windows 6.0.6002 Service Pack 2 Internet Explorer 9.0.8112.16421 27.05.2011 20:20:05 mbam-log-2011-05-27 (20-20-02).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|) Durchsuchte Objekte: 393740 Laufzeit: 1 Stunde(n), 25 Minute(n), 32 Sekunde(n) Infizierte Speicherprozesse: 1 Infizierte Speichermodule: 0 Infizierte Registrierungsschlüssel: 4 Infizierte Registrierungswerte: 1 Infizierte Dateiobjekte der Registrierung: 0 Infizierte Verzeichnisse: 0 Infizierte Dateien: 4 Infizierte Speicherprozesse: c:\programdata\ceeiljmubgbadu.exe (Trojan.FakeMS) -> 4144 -> No action taken. Infizierte Speichermodule: (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: HKEY_CLASSES_ROOT\CLSID\{A3EF6FD4-4769-4734-9494-4707087225B9} (Trojan.Banker) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3EF6FD4-4769-4734-9494-4707087225B9} (Trojan.Banker) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{A3EF6FD4-4769-4734-9494-4707087225B9} (Trojan.Banker) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A3EF6FD4-4769-4734-9494-4707087225B9} (Trojan.Banker) -> No action taken. Infizierte Registrierungswerte: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ceeiLjmUBGBADu (Trojan.FakeMS) -> Value: ceeiLjmUBGBADu -> No action taken. Infizierte Dateiobjekte der Registrierung: (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: (Keine bösartigen Objekte gefunden) Infizierte Dateien: c:\programdata\ceeiljmubgbadu.exe (Trojan.FakeMS) -> No action taken. c:\Users\Papa\AppData\Roaming\acroiehelpe.dll (Trojan.Banker) -> No action taken. c:\programdata\34660088.exe (Trojan.FakeMS) -> No action taken. c:\Users\Papa\AppData\Local\Temp\tmpAE39.tmp (Trojan.FakeMS) -> No action taken. |
|
28.05.2011, 11:33
| #2 |
| /// Malware-holic   | Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons • Starte bitte die OTL.exe
__________________• Kopiere nun das Folgende in die Textbox. Code:
ATTFilter
:OTL
O4 - HKCU..\Run: [ceeiLjmUBGBADu] C:\ProgramData\ceeiLjmUBGBADu.exe (Microsoft Corporation)
[2011.05.26 21:34:05 | 000,365,056 | -H-- | C] (Microsoft Corporation) -- C:\ProgramData\34660088.exe
[2011.05.15 12:13:48 | 000,000,000 | -H-D | C] -- C:\Users\Papa\Documents\Logopak
[2011.03.22 21:47:08 | 000,236,496 | -H-- | C] (Adobe Systems, Incorporated) -- C:\Users\Papa\AppData\Roaming\AcroIEHelpe.dll
:Files
C:\ProgramData\ceeiLjmUBGBADu.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
• Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. lade unhide: http://www.trojaner-board.de/54791-a...ner-board.html
__________________ |
|
29.05.2011, 19:42
| #3 |
| | Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons Hallo,
__________________erstmal vielen Dank für Eure Unterstützng. Den OTL-Fix Text habe ich unten angehängt. Beim Booten des Rechners hat Anti-Vir erstmals den Trojaner "ceeiLjmUBGBADu.exe" gemeldet. Ich habe keine Aktion durchgeführt. Nach(?!?) dem OTL-Fix hat Anti-Vir wieder den Trojaner "ceeiLjmUBGBADu.exe" gemeldet. Ich habe dann "Entfernen" gedrückt. Grüße All processes killed ========== OTL ========== Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ceeiLjmUBGBADu deleted successfully. File move failed. C:\ProgramData\ceeiLjmUBGBADu.exe scheduled to be moved on reboot. C:\ProgramData\34660088.exe moved successfully. C:\Users\Papa\Documents\Logopak folder moved successfully. C:\Users\Papa\AppData\Roaming\AcroIEHelpe.dll moved successfully. ========== FILES ========== File move failed. C:\ProgramData\ceeiLjmUBGBADu.exe scheduled to be moved on reboot. ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: Default User: Default User User: Papa ->Flash cache emptied: 55880 bytes User: Public Total Flash Files Cleaned = 0,00 mb [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Papa ->Temp folder emptied: 877384413 bytes ->Temporary Internet Files folder emptied: 419080596 bytes ->Java cache emptied: 51415388 bytes ->FireFox cache emptied: 92611768 bytes ->Flash cache emptied: 0 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 70966405 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 1.441,00 mb OTL by OldTimer - Version 3.2.23.0 log created on 05292011_201605 Files\Folders moved on Reboot... File move failed. C:\ProgramData\ceeiLjmUBGBADu.exe scheduled to be moved on reboot. C:\Users\Papa\AppData\Local\Temp\~DF5387.tmp moved successfully. File\Folder C:\Windows\temp\ZLT064b9.TMP not found! Registry entries deleted on Reboot... Grüße Geändert von weddeltown (29.05.2011 um 20:01 Uhr) |
|
30.05.2011, 11:02
| #4 |
| /// Malware-holic | Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons bitte erstelle und poste ein combofix log. Ein Leitfaden und Tutorium zur Nutzung von ComboFix
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
31.05.2011, 18:54
| #5 |
| | Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons Hallo, unten stehend die Log-Datei von ComboFix. Grüße Combofix Logfile: Code:
ATTFilter ComboFix 11-05-31.01 - Papa 31.05.2011 19:36:06.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3325.2129 [GMT 2:00]
ausgeführt von:: c:\users\Papa\Desktop\ComboFix.exe
FW: ZoneAlarm Firewall *Disabled* {D17DF357-CFF5-F001-D1C1-FCD21DFE3D5E}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Philips SPC210NC Webcam
c:\programdata\Microsoft\Windows\Start Menu\Programs\Philips SPC210NC Webcam \Philips VRecord software.lnk
c:\programdata\Microsoft\Windows\Start Menu\Programs\Philips SPC210NC Webcam \Uninstall Philips SPC210NC Webcam.lnk
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-04-28 bis 2011-05-31 ))))))))))))))))))))))))))))))
.
.
2011-05-31 17:44 . 2011-05-31 17:44 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-05-31 17:32 . 2011-05-31 17:33 -------- d-----w- C:\32788R22FWJFW
2011-05-31 17:29 . 2011-05-09 20:46 6962000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{26122B31-A2AE-4595-9277-B05D4449B8BC}\mpengine.dll
2011-05-26 20:52 . 2011-05-26 20:52 -------- d-----w- c:\users\Papa\AppData\Roaming\Malwarebytes
2011-05-26 20:52 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-26 20:52 . 2011-05-26 20:52 -------- d-----w- c:\programdata\Malwarebytes
2011-05-26 20:51 . 2011-05-26 20:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-26 20:51 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-24 14:48 . 2011-05-24 14:48 1138440 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-05-15 17:12 . 2011-05-15 17:12 -------- d-----w- c:\users\Papa\AppData\Roaming\Amazon
2011-05-15 17:11 . 2011-05-15 17:11 -------- d-----w- c:\program files\Amazon
2011-05-10 18:51 . 2011-04-07 12:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-30 10:45 . 2011-04-30 10:45 86528 ----a-w- c:\windows\system32\iesysprep.dll
2011-04-30 10:45 . 2011-04-30 10:45 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-04-30 10:45 . 2011-04-30 10:45 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-04-30 10:45 . 2011-04-30 10:45 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-04-30 10:45 . 2011-04-30 10:45 161792 ----a-w- c:\windows\system32\msls31.dll
2011-04-30 10:45 . 2011-04-30 10:45 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-04-30 10:45 . 2011-04-30 10:45 74752 ----a-w- c:\windows\system32\iesetup.dll
2011-04-30 10:45 . 2011-04-30 10:45 63488 ----a-w- c:\windows\system32\tdc.ocx
2011-04-30 10:45 . 2011-04-30 10:45 367104 ----a-w- c:\windows\system32\html.iec
2011-04-30 10:45 . 2011-04-30 10:45 23552 ----a-w- c:\windows\system32\licmgr10.dll
2011-04-30 10:45 . 2011-04-30 10:45 152064 ----a-w- c:\windows\system32\wextract.exe
2011-04-30 10:45 . 2011-04-30 10:45 150528 ----a-w- c:\windows\system32\iexpress.exe
2011-04-30 10:45 . 2011-04-30 10:45 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2011-04-30 10:45 . 2011-04-30 10:45 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-04-30 10:45 . 2011-04-30 10:45 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-04-30 10:45 . 2011-04-30 10:45 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-04-30 10:45 . 2011-04-30 10:45 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2011-04-30 10:45 . 2011-04-30 10:45 11776 ----a-w- c:\windows\system32\mshta.exe
2011-04-30 10:45 . 2011-04-30 10:45 101888 ----a-w- c:\windows\system32\admparse.dll
2011-04-30 10:45 . 2011-04-30 10:45 35840 ----a-w- c:\windows\system32\imgutil.dll
2011-04-30 10:45 . 2011-04-30 10:45 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-04-29 11:24 . 2009-10-27 19:24 4175872 ----a-w- c:\windows\DVAPI32.DLL
2011-04-28 14:07 . 2009-10-27 19:24 8420352 ----a-w- c:\windows\TOBITCLT.DLL
2011-04-14 15:44 . 2009-10-27 19:24 183808 ----a-w- c:\windows\system32\DV4TS.EXE
2011-03-23 15:08 . 2009-10-27 19:24 3560792 ----a-w- c:\windows\uninstic.exe
2011-03-22 19:47 . 2011-03-22 19:47 112 ----a-w- c:\users\Papa\AppData\Roaming\srvblck2.tmp
2011-03-17 18:25 . 2009-03-22 18:58 137656 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-03-12 21:55 . 2011-04-26 19:37 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-03-10 17:03 . 2011-04-20 19:39 1162240 ----a-w- c:\windows\system32\mfc42u.dll
2011-03-10 17:03 . 2011-04-20 19:39 1136640 ----a-w- c:\windows\system32\mfc42.dll
2011-03-03 15:42 . 2011-04-20 19:38 739328 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-03 15:40 . 2011-04-26 19:37 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2011-03-03 15:40 . 2011-04-26 19:37 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2011-03-03 15:40 . 2011-04-26 19:37 542720 ----a-w- c:\windows\apppatch\AcLayers.dll
2011-03-03 15:40 . 2011-04-26 19:37 458752 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2011-03-03 15:40 . 2011-04-26 19:37 2159616 ----a-w- c:\windows\apppatch\AcGenral.dll
2011-03-03 13:35 . 2011-04-26 19:37 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-03-03 13:25 . 2011-04-20 19:38 2041856 ----a-w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-08 178712]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"toolbar_eula_launcher"="c:\program files\GoogleEULA\EULALauncher.exe" [2007-02-09 16896]
"RtHDVCpl"="RtHDVCpl.exe" [2008-02-13 4915200]
"Skytel"="Skytel.exe" [2007-11-20 1826816]
"lxdxmon.exe"="c:\program files\Lexmark 3600-4600 Series\lxdxmon.exe" [2008-03-20 668328]
"lxdxamon"="c:\program files\Lexmark 3600-4600 Series\lxdxamon.exe" [2008-03-20 16040]
"BigDogPath"="c:\windows\VM_STI.EXE" [2004-06-09 40960]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2008-01-29 92704]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-29 8530464]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-01-29 88608]
"PlayMovie"="c:\program files\HomeCinema\PlayMovie\PMVService.exe" [2007-09-07 172032]
"UpdatePPShortCut"="c:\program files\HomeCinema\PowerProducer\MUITransfer\MUIStartMenu.exe" [2007-09-13 222504]
"TVEService"="c:\program files\HomeCinema\TV Enhance\TVEService.exe" [2007-10-19 155648]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-01-13 37888]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-05 281768]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2009-03-18 75048]
"RemoteControl"="c:\program files\HomeCinema\PowerDVD\PDVDServ.exe" [2008-07-21 87336]
"LanguageShortcut"="c:\program files\HomeCinema\PowerDVD\Language\Language.exe" [2008-05-14 62760]
"DV4TS.EXE"="c:\windows\system32\DV4TS.EXE" [2011-04-14 183808]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2009-09-05 385024]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-16 141608]
"ContentTransferWMDetector.exe"="c:\program files\Sony\Content Transfer\ContentTransferWMDetector.exe" [2009-11-19 583016]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2011-02-18 1043968]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
TrayMin210.exe.lnk - c:\program files\Philips\Philips SPC210NC Webcam\TrayMin210.exe [2009-2-14 278528]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DSL-Manager.lnk - c:\program files\T-Online\DSL-Manager\DslMgr.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 dsltestSp5;dsltestSp5 NDIS Protocol Driver;c:\windows\system32\Drivers\dsltestSp5.sys [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2009-04-22 9728]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2009-04-22 3072]
R3 IntelDH;IntelDH Driver;c:\windows\system32\Drivers\IntelDH.sys [2008-03-05 5504]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [x]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [x]
R3 vsdatant7;vsdatant7;c:\windows\system32\drivers\vsdatant.win7.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [2008-01-19 16896]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2010-12-03 64288]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};{49DE1C67-83F8-4102-99E0-C16DCC7EEC796};c:\program files\HomeCinema\PlayMovie\000.fcl [2007-10-11 41456]
S2 AAV UpdateService;AAV UpdateService;c:\program files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [2008-10-24 128296]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-05-06 136360]
S2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe [2008-02-28 594600]
S2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\system32\spool\DRIVERS\W32X86\3\\lxdxserv.exe [2008-02-28 98984]
S2 TVECapSvc;TVEnhance Background Capture Service (TBCS);c:\program files\HomeCinema\TV Enhance\Kernel\TV\TVECapSvc.exe [2007-10-19 290909]
S2 TVESched;TVEnhance Task Scheduler (TTS));c:\program files\HomeCinema\TV Enhance\Kernel\TV\TVESched.exe [2007-10-19 114779]
S3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2007-08-22 1242976]
S3 avmaudio;AVM Audio;c:\windows\system32\DRIVERS\avmaudio.sys [2009-06-20 101248]
S3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2007-09-21 554496]
S3 X10Hid;X10 Hid Device;c:\windows\system32\Drivers\x10hid.sys [2006-11-17 13976]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube Download - c:\users\Papa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Papa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - eBay - eine der größten deutschen Shopping-Websites
TCP: DhcpNameServer = 10.42.0.1
FF - ProfilePath - c:\users\Papa\AppData\Roaming\Mozilla\Firefox\Profiles\uras7n3k.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2613550&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - ZoneAlarm-Sicherheit Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2613550&SearchSource=13
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: JavaString Helper: {E5886C91-CDD7-4832-B32D-0830705A9C60} - c:\users\Papa\AppData\Roaming\5012
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - Ext: JavaString Helper: {E5886C91-CDD7-4832-B32D-0830705A9C60} - c:\users\Papa\AppData\Roaming\5012
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2011-05-31 19:44
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\HomeCinema\PlayMovie\000.fcl"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\HomeCinema\PowerDVD\000.fcl"
.
Zeit der Fertigstellung: 2011-05-31 19:47:17
ComboFix-quarantined-files.txt 2011-05-31 17:47
.
Vor Suchlauf: 14 Verzeichnis(se), 67.145.936.896 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 67.076.825.088 Bytes frei
.
Current=1 Default=1 Failed=0 LastKnownGood=19 Sets=1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19
- - End Of File - - 3BBF93274C1C4289D015790858B9CF79
|
|
31.05.2011, 19:37
| #6 |
| /// Malware-holic | Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons welche probleme gibt es noch?
__________________ --> Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons |
|
01.06.2011, 20:39
| #7 |
| | Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons Hallo, erstmal wieder Danke! Ich denke, dass keine gravierenden Probleme mehr vorhanden sind. Die Taskleiste und das Feld über "Start" mit Programme, Dokumente, etc. sind noch leer. Bei der Taskleiste habe ich nur das Problem mit dem Desktop Icon, die anderen kann man ja so "reinziehen". Kann man diese Dinge auch noch beheben? Gruß |
|
14.06.2011, 20:37
| #8 |
| | Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons Danke für die Hilfe! Spende ist unterwegs. Grüße |
|
15.06.2011, 10:04
| #9 |
| /// Malware-holic | Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons sorry hatte das übersehen, hat sich das mit der schnellstart leiste gegeben? und thx für die spende
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
16.06.2011, 18:54
| #10 |
| | Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons Konnte das Desktop Icon in der Schnellstartleiste leider noch nicht wieder hinzufügen. Habe gefunden, dass man eine Datei desktop.scf (siehe unten) auf dem Desktop erstellen und dann das Icon in die Schnellstartleiste ziehen soll. Bei mir geht aber nur das Dokument auf, wenn ich in der Schnellstartleiste auf das Icon drücke. Scheint wohl nur bei XP zu funktionieren. [Shell] Command=2 IconFile=explorer.exe,3 [Taskbar] Command=ToggleDesktop |
|
16.06.2011, 18:58
| #11 |
| /// Malware-holic | Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons du willst ein icon in der schnelstart leiste um den desktop zu erreichen? wie sinnlos ist dass denn... minimiere dein eprogramme und du bist auf dem desktop.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
17.06.2011, 18:05
| #12 |
| | Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons Stimmt, das ist eine Möglichkeit. Aber wenn man mehrere Anwendungen geöffnet hat, ist (war) es schon sehr hilfreich. Ein Klick, und man war auf dem Desktop. Werde jetzt ALT+TAB benutzen.... |
|
| Themen zu Fehlermeldung: Festplatte defekt und danach schwarzer Desktop ohne Icons |
| bedeuten, c:\windows\system32\rundll32.exe, defekt, desktop, durchgeführt, fehlermeldung, fehlermeldungen, festplatte, festplatte defekt, gen, hoffe, home, icon, icons, install.exe, komische, nvlddmkm.sys, oldtimer, platte, plug-in, rechner, registry cleaner, runter, sched.exe, schei, schwarzer, schwarzer desktop, searchplugins, security update, sofort, start menu, stehe, suche, total commander, trojan.fakems, vista, windows, windows vista, windows vista home |
Linear-Darstellung
