| aligigan | 22.04.2011 19:38 |
Windows Recovery - vollständig entfernt?
Guten Tag,
auch ich hab mir den Windows Recovery eingefangen und habe ich auch schon zu einem Großteil dank eurer Anleitung (herzliches Danke an dieser Stelle) entfernen können.
Einziges Problem jetzt ist noch, dass ich nicht in der Lage bin meinen Desktophintergrund zu verändern und dass ich denke, dass mein PC etwas an Leistung (geschwindigkeit) nachgelassen hat.
Log vor Entfernung der befallenen Dateien: Code:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 6415
Windows 6.1.7600
Internet Explorer 8.0.7600.16385
22.04.2011 00:26:50
mbam-log-2011-04-22 (00-26-50).txt
Art des Suchlaufs: Vollständiger Suchlauf (A:\|C:\|D:\|E:\|F:\|G:\|H:\|)
Durchsuchte Objekte: 267166
Laufzeit: 40 Minute(n), 48 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 1
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 4
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uvEWQXCeAJwf (Trojan.FakeAlert) -> Value: uvEWQXCeAJwf -> Quarantined and deleted successfully.
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
c:\programdata\uvewqxceajwf.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\programdata\32759560.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Name\AppData\Local\Temp\tmpCB9A.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Name\AppData\LocalLow\Sun\Java\deployment\cache\6.0\0\7ce97b00-6906e024 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
OTL: Code:
OTL logfile created on: 22.04.2011 19:19:04 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = E:\antivirus
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 57,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 75,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 48,83 Gb Total Space | 26,47 Gb Free Space | 54,22% Space Free | Partition Type: NTFS
Drive D: | 48,83 Gb Total Space | 19,32 Gb Free Space | 39,56% Space Free | Partition Type: NTFS
Drive E: | 48,83 Gb Total Space | 45,86 Gb Free Space | 93,93% Space Free | Partition Type: NTFS
Drive F: | 48,83 Gb Total Space | 24,61 Gb Free Space | 50,40% Space Free | Partition Type: NTFS
Drive G: | 37,57 Gb Total Space | 26,37 Gb Free Space | 70,19% Space Free | Partition Type: NTFS
Computer Name: ALEX-PC | User Name: Alex | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - E:\antivirus\OTL.exe (OldTimer Tools)
PRC - E:\firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
PRC - C:\Windows\System32\mfevtps.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - E:\Malewarebytes\Malwarebytes' Anti-Malware\herbert.exe.exe (Malwarebytes Corporation)
PRC - C:\Programme\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
PRC - C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
PRC - G:\Tobit Radio.fx\Client\rfx-tray.exe (Tobit.Software)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - E:\OpenOffice\program\soffice.bin (OpenOffice.org)
PRC - E:\OpenOffice\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\Common Files\aol\ACS\AOLDial.exe (America Online, Inc)
PRC - C:\PROGRA~2\COMMON~1\aol\ACS\AOLacsd.exe (America Online, Inc.)
========== Modules (SafeList) ==========
MOD - E:\antivirus\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)
MOD - c:\Programme\McAfee\SiteAdvisor\sahook.dll ()
========== Win32 Services (SafeList) ==========
SRV - (mfefire) -- C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.)
SRV - (mfevtp) -- C:\Windows\System32\mfevtps.exe (McAfee, Inc.)
SRV - (McODS) -- C:\Program Files\McAfee\VirusScan\mcods.exe (McAfee, Inc.)
SRV - (McShield) -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV - (McProxy) -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNASvc) -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McNaiAnn) -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (mcmscsvc) -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McMPFSvc) -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (McAfee SiteAdvisor Service) -- C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (AOL ACS) -- C:\PROGRA~2\COMMON~1\aol\ACS\AOLacsd.exe (America Online, Inc.)
========== Driver Services (SafeList) ==========
DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (mfehidk) -- C:\Windows\system32\drivers\mfehidk.sys (McAfee, Inc.)
DRV - (mfefirek) -- C:\Windows\System32\drivers\mfefirek.sys (McAfee, Inc.)
DRV - (mfewfpk) -- C:\Windows\system32\drivers\mfewfpk.sys (McAfee, Inc.)
DRV - (mfeavfk) -- C:\Windows\System32\drivers\mfeavfk.sys (McAfee, Inc.)
DRV - (mfeapfk) -- C:\Windows\System32\drivers\mfeapfk.sys (McAfee, Inc.)
DRV - (mferkdet) -- C:\Windows\System32\drivers\mferkdet.sys (McAfee, Inc.)
DRV - (mfenlfk) -- C:\Windows\System32\drivers\mfenlfk.sys (McAfee, Inc.)
DRV - (cfwids) -- C:\Windows\System32\drivers\cfwids.sys (McAfee, Inc.)
DRV - (mfebopk) -- C:\Windows\System32\drivers\mfebopk.sys (McAfee, Inc.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm62x32.sys (NVIDIA Corporation)
DRV - (wind502u) -- C:\Windows\System32\drivers\wind502u.sys (Envara Inc.)
DRV - (wanatw) WAN Miniport (ATW) -- C:\Windows\System32\drivers\wanatw4.sys (America Online, Inc.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.icq.com/
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "ICQ Search"
FF - prefs.js..browser.startup.homepage: "facebook.de"
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {872b5b88-9db5-4310-bdd0-ac189557e5f5}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:3.3.1
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010.10.27 21:07:07 | 000,000,000 | ---D | M]
[2010.10.29 22:19:09 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Alex\AppData\Roaming\mozilla\Extensions
[2011.04.21 21:42:00 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Alex\AppData\Roaming\mozilla\Firefox\Profiles\591l1v86.default\extensions
[2010.11.26 18:35:16 | 000,000,000 | -H-D | M] (DVDVideoSoftTB Toolbar) -- C:\Users\Alex\AppData\Roaming\mozilla\Firefox\Profiles\591l1v86.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2010.11.13 11:32:04 | 000,000,000 | -H-D | M] ("DVDVideoSoft Menu") -- C:\Users\Alex\AppData\Roaming\mozilla\Firefox\Profiles\591l1v86.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.04.16 23:44:52 | 000,000,958 | -H-- | M] () -- C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\591l1v86.default\searchplugins\icqplugin.xml
[2011.04.20 15:56:01 | 000,000,000 | ---D | M] (McAfee SiteAdvisor) -- C:\PROGRAM FILES\MCAFEE\SITEADVISOR
[2011.03.28 22:05:03 | 000,000,000 | ---D | M] (Skype extension) -- E:\FIREFOX\EXTENSIONS\{AB2CE124-6272-4B12-94A9-7303C7397BD1}
[2010.05.27 19:10:07 | 000,000,000 | ---D | M] (Java Console) -- E:\FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.10.22 16:03:42 | 000,000,000 | ---D | M] (Java Console) -- E:\FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx ()
O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20101208200934.dll (McAfee, Inc.)
O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll ()
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll ()
O4 - HKLM..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe (America Online, Inc)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] E:\Malewarebytes\Malwarebytes' Anti-Malware\herbert.exe.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] E:\Malewarebytes\Malwarebytes' Anti-Malware\malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [mcui_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.)
O4 - HKCU..\Run: [RfxSrvTray] G:\Tobit Radio.fx\Client\rfx-tray.exe (Tobit.Software)
O4 - Startup: C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Auto Shutdown.lnk = E:\automatic shutdown\Auto Shutdown\AutoShutdown.exe (Entru Inc.)
O4 - Startup: C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk = E:\OpenOffice\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Free YouTube Download - C:\Users\Alex\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Alex\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll ()
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Programme\McAfee\SiteAdvisor\McIEPlg.dll ()
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2010.11.13 01:19:42 | 000,000,000 | ---D | M] - E:\automatic shutdown -- [ NTFS ]
O32 - AutoRun File - [2010.05.27 22:35:08 | 000,000,000 | ---D | M] - E:\autostart -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011.04.22 18:08:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
[2011.04.21 21:56:29 | 000,000,000 | -H-D | C] -- C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Recovery
[2011.04.16 00:28:00 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2011.04.16 00:28:00 | 000,428,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2011.04.16 00:27:57 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe
[2011.04.16 00:27:51 | 000,294,912 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2011.04.16 00:27:51 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2011.04.16 00:27:31 | 000,606,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011.04.16 00:27:31 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.04.16 00:27:31 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2011.04.16 00:27:30 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011.04.16 00:27:30 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2011.04.16 00:27:30 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2011.04.16 00:27:29 | 001,638,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2011.04.16 00:27:29 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011.04.16 00:27:29 | 000,048,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2011.04.16 00:27:29 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2011.04.16 00:27:29 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2011.04.16 00:27:01 | 002,331,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011.04.16 00:26:57 | 000,191,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\FXSCOVER.exe
[2011.04.16 00:26:55 | 000,288,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsGdiConverter.dll
[2011.04.16 00:26:51 | 001,164,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll
[2011.04.16 00:26:51 | 001,137,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll
[2011.03.29 22:17:15 | 000,000,000 | -H-D | C] -- C:\Users\Alex\Documents\TubeBox!
[2011.03.29 22:17:15 | 000,000,000 | -H-D | C] -- C:\Users\Alex\AppData\Roaming\TubeBox
[2011.03.29 22:17:00 | 000,000,000 | -H-D | C] -- C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TubeBox!
[2011.03.28 22:04:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.03.28 22:04:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2011.03.28 13:09:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free M4a to MP3 Converter
========== Files - Modified Within 30 Days ==========
[2011.04.22 18:51:01 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.04.22 18:13:52 | 000,001,277 | ---- | M] () -- C:\Users\Alex\Desktop\herbert.exe.exe - Verknüpfung.lnk
[2011.04.22 18:13:17 | 000,013,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.04.22 18:13:17 | 000,013,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.04.22 18:13:15 | 000,000,921 | ---- | M] () -- C:\Users\Alex\Desktop\ICQ.exe - Verknüpfung.lnk
[2011.04.22 18:13:05 | 000,001,061 | ---- | M] () -- C:\Users\Alex\Desktop\Core Temp.exe - Verknüpfung.lnk
[2011.04.22 18:12:30 | 000,000,988 | ---- | M] () -- C:\Users\Alex\Desktop\FormatFactory.exe - Verknüpfung.lnk
[2011.04.22 18:12:10 | 000,001,378 | ---- | M] () -- C:\Users\Alex\Desktop\FreeYouTubeToMP3Converter.exe - Verknüpfung.lnk
[2011.04.22 18:11:39 | 000,001,034 | ---- | M] () -- C:\Users\Alex\Desktop\TubeBox.exe - Verknüpfung.lnk
[2011.04.22 18:11:11 | 000,001,252 | ---- | M] () -- C:\Users\Alex\Desktop\FreeYouTubeDownload.exe - Verknüpfung.lnk
[2011.04.22 18:08:01 | 000,001,828 | ---- | M] () -- C:\Users\Public\Desktop\McAfee AntiVirus Plus.lnk
[2011.04.22 18:05:54 | 000,001,088 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.04.22 18:05:46 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.04.22 18:05:43 | 2415,321,088 | -HS- | M] () -- C:\hiberfil.sys
[2011.04.19 20:18:07 | 260,337,281 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011.04.17 16:56:37 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.04.17 16:56:37 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.04.17 16:56:37 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.04.17 16:56:37 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.04.16 13:16:38 | 000,283,280 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.03.28 22:04:41 | 000,002,505 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
========== Files Created - No Company Name ==========
[2011.04.22 18:13:54 | 000,001,277 | ---- | C] () -- C:\Users\Alex\Desktop\herbert.exe.exe - Verknüpfung.lnk
[2011.04.22 18:13:17 | 000,000,921 | ---- | C] () -- C:\Users\Alex\Desktop\ICQ.exe - Verknüpfung.lnk
[2011.04.22 18:13:07 | 000,001,061 | ---- | C] () -- C:\Users\Alex\Desktop\Core Temp.exe - Verknüpfung.lnk
[2011.04.22 18:12:53 | 000,000,445 | ---- | C] () -- C:\Users\Alex\Desktop\Verknüpfung mit Wow.lnk
[2011.04.22 18:12:32 | 000,000,988 | ---- | C] () -- C:\Users\Alex\Desktop\FormatFactory.exe - Verknüpfung.lnk
[2011.04.22 18:12:12 | 000,001,378 | ---- | C] () -- C:\Users\Alex\Desktop\FreeYouTubeToMP3Converter.exe - Verknüpfung.lnk
[2011.04.22 18:11:41 | 000,001,034 | ---- | C] () -- C:\Users\Alex\Desktop\TubeBox.exe - Verknüpfung.lnk
[2011.04.22 18:11:15 | 000,001,252 | ---- | C] () -- C:\Users\Alex\Desktop\FreeYouTubeDownload.exe - Verknüpfung.lnk
[2011.01.22 23:37:00 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011.01.04 15:37:35 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2011.01.04 15:37:35 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2011.01.04 15:37:35 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2011.01.04 15:30:04 | 000,000,218 | ---- | C] () -- C:\Windows\SIERRA.INI
[2010.12.09 18:12:54 | 000,010,752 | -H-- | C] () -- C:\Users\Alex\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.11.06 23:50:01 | 000,000,335 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.10.29 23:38:40 | 000,001,732 | R--- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2010.10.29 21:52:02 | 000,022,720 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat
[2009.07.14 10:47:43 | 000,653,928 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 10:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 10:47:43 | 000,129,800 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 10:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 06:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 06:33:53 | 000,283,280 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 04:05:48 | 000,615,810 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 04:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 04:05:48 | 000,106,190 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 04:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 04:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 04:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 01:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 01:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2008.10.07 10:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2008.10.07 10:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008.10.07 10:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2007.12.04 19:41:00 | 001,703,936 | ---- | C] () -- C:\Windows\System32\nvwdmcpl.dll
[2007.12.04 19:41:00 | 001,626,112 | ---- | C] () -- C:\Windows\System32\nwiz.exe
[2007.12.04 19:41:00 | 001,474,560 | ---- | C] () -- C:\Windows\System32\nview.dll
[2007.12.04 19:41:00 | 001,339,392 | ---- | C] () -- C:\Windows\System32\nvdspsch.exe
[2007.12.04 19:41:00 | 001,019,904 | ---- | C] () -- C:\Windows\System32\nvwimg.dll
[2007.12.04 19:41:00 | 000,466,944 | ---- | C] () -- C:\Windows\System32\nvshell.dll
[2007.12.04 19:41:00 | 000,442,368 | ---- | C] () -- C:\Windows\System32\nvappbar.exe
[2007.12.04 19:41:00 | 000,425,984 | ---- | C] () -- C:\Windows\System32\keystone.exe
[2007.12.04 19:41:00 | 000,286,720 | ---- | C] () -- C:\Windows\System32\nvnt4cpl.dll
========== LOP Check ==========
[2010.12.09 22:34:28 | 000,000,000 | -H-D | M] -- C:\Users\Alex\AppData\Roaming\avidemux
[2010.12.08 22:54:52 | 000,000,000 | -H-D | M] -- C:\Users\Alex\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.03.28 22:02:32 | 000,000,000 | -H-D | M] -- C:\Users\Alex\AppData\Roaming\ICQ
[2011.01.06 01:43:15 | 000,000,000 | -H-D | M] -- C:\Users\Alex\AppData\Roaming\InterTrust
[2011.02.10 23:50:27 | 000,000,000 | -H-D | M] -- C:\Users\Alex\AppData\Roaming\Learn2.com
[2010.12.09 23:01:44 | 000,000,000 | -H-D | M] -- C:\Users\Alex\AppData\Roaming\MPEG Streamclip
[2010.11.10 01:34:49 | 000,000,000 | -H-D | M] -- C:\Users\Alex\AppData\Roaming\Tobit
[2011.03.29 22:17:15 | 000,000,000 | -H-D | M] -- C:\Users\Alex\AppData\Roaming\TubeBox
[2011.04.11 22:51:17 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
< End of report >
Code:
OTL Extras logfile created on: 22.04.2011 19:19:04 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = E:\antivirus
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 57,00% Memory free
6,00 Gb Paging File | 5,00 Gb Available in Paging File | 75,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 48,83 Gb Total Space | 26,47 Gb Free Space | 54,22% Space Free | Partition Type: NTFS
Drive D: | 48,83 Gb Total Space | 19,32 Gb Free Space | 39,56% Space Free | Partition Type: NTFS
Drive E: | 48,83 Gb Total Space | 45,86 Gb Free Space | 93,93% Space Free | Partition Type: NTFS
Drive F: | 48,83 Gb Total Space | 24,61 Gb Free Space | 50,40% Space Free | Partition Type: NTFS
Drive G: | 37,57 Gb Total Space | 26,37 Gb Free Space | 70,19% Space Free | Partition Type: NTFS
Computer Name: ALEX-PC | User Name: Alex | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- E:\firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "E:\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "E:\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{220688FD-4E64-4810-B31A-32C3895DFDFA}_is1" = Auto Shutdown
"{2447500B-22D7-47BD-9B13-1A927F43A267}" = Empire Earth
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 23
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50E21B3A-FF06-412D-879B-DEA30815736E}" = OpenOffice.org 2.4
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC54E544-3E42-443C-A91D-A00A6974C592}" = NVIDIA PhysX v8.10.13
"{C768790F-04FB-11E0-9B2C-001AA037B01E}" = Google Earth
"{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars
"{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
"{EAE8F6AB-68E8-4AA9-9518-F677090690B2}" = TubeBox!
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"America Online de" = AOL Deutschland
"AOL Connectivity Services" = AOL Optimized Dial-In
"AOL YGP Screensaver" = AOL Meine Fotos Bildschirmschoner
"AOLCoach de" = AOL Coach Version 1.0(Build:20040201.2 de)
"Avidemux 2.5" = Avidemux 2.5
"Fahr-Simulator 2009_is1" = Fahr-Simulator 2009 Demo
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.2
"Free YouTube Download_is1" = Free YouTube Download version 2.10.29
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"MSC" = McAfee AntiVirus Plus
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"RealPlayer 6.0" = RealPlayer Basic
"StreetPlugin" = Learn2 Player (Uninstall Only)
"Tobit Radio.fx Client" = Radio.fx
"Uninstall_is1" = Uninstall 1.0.0.1
"ViewpointMediaPlayer" = Viewpoint Media Player
"Virtual Stratton" = Virtual Stratton (remove only)
"VLC media player" = VLC media player 1.0.3
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mozilla Firefox (3.5.18)" = Mozilla Firefox (3.5.18)
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 29.03.2011 14:38:19 | Computer Name = Alex-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: AutoShutdown.exe, Version: 1.0.0.42,
Zeitstempel: 0x4b15878d Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bdaae Ausnahmecode: 0x0eedfade Fehleroffset: 0x00009617 ID des fehlerhaften
Prozesses: 0xa4c Startzeit der fehlerhaften Anwendung: 0x01cbee4072ab9460 Pfad der
fehlerhaften Anwendung: E:\automatic shutdown\Auto Shutdown\AutoShutdown.exe Pfad
des fehlerhaften Moduls: C:\Windows\system32\KERNELBASE.dll Berichtskennung: b785e400-5a33-11e0-ac0b-00038a000015
Error - 31.03.2011 16:59:19 | Computer Name = Alex-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: AutoShutdown.exe, Version: 1.0.0.42,
Zeitstempel: 0x4b15878d Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bdaae Ausnahmecode: 0x0eedfade Fehleroffset: 0x00009617 ID des fehlerhaften
Prozesses: 0x9a4 Startzeit der fehlerhaften Anwendung: 0x01cbefe67446ca40 Pfad der
fehlerhaften Anwendung: E:\automatic shutdown\Auto Shutdown\AutoShutdown.exe Pfad
des fehlerhaften Moduls: C:\Windows\system32\KERNELBASE.dll Berichtskennung: be8f1da0-5bd9-11e0-add6-00038a000015
Error - 08.04.2011 14:12:07 | Computer Name = Alex-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe_Netman, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bc100 Name des fehlerhaften Moduls: RPCRT4.dll, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bdade Ausnahmecode: 0xc0000005 Fehleroffset: 0x0002594e ID des fehlerhaften
Prozesses: 0x3e4 Startzeit der fehlerhaften Anwendung: 0x01cbf5f226768780 Pfad der
fehlerhaften Anwendung: C:\Windows\System32\svchost.exe Pfad des fehlerhaften Moduls:
C:\Windows\system32\RPCRT4.dll Berichtskennung: b69ccab0-620b-11e0-b16d-00038a000015
Error - 15.04.2011 18:20:56 | Computer Name = Alex-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: AutoShutdown.exe, Version: 1.0.0.42,
Zeitstempel: 0x4b15878d Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bdaae Ausnahmecode: 0x0eedfade Fehleroffset: 0x00009617 ID des fehlerhaften
Prozesses: 0xaa8 Startzeit der fehlerhaften Anwendung: 0x01cbfbbb5e09cda0 Pfad der
fehlerhaften Anwendung: E:\automatic shutdown\Auto Shutdown\AutoShutdown.exe Pfad
des fehlerhaften Moduls: C:\Windows\system32\KERNELBASE.dll Berichtskennung: a1cb0c20-67ae-11e0-8b8c-00038a000015
Error - 16.04.2011 10:06:22 | Computer Name = Alex-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: AutoShutdown.exe, Version: 1.0.0.42,
Zeitstempel: 0x4b15878d Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bdaae Ausnahmecode: 0x0eedfade Fehleroffset: 0x00009617 ID des fehlerhaften
Prozesses: 0xa48 Startzeit der fehlerhaften Anwendung: 0x01cbfc3f7499a2a0 Pfad der
fehlerhaften Anwendung: E:\automatic shutdown\Auto Shutdown\AutoShutdown.exe Pfad
des fehlerhaften Moduls: C:\Windows\system32\KERNELBASE.dll Berichtskennung: b4b5d5c0-6832-11e0-82cb-00038a000015
Error - 18.04.2011 14:08:37 | Computer Name = Alex-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: AutoShutdown.exe, Version: 1.0.0.42,
Zeitstempel: 0x4b15878d Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bdaae Ausnahmecode: 0x0eedfade Fehleroffset: 0x00009617 ID des fehlerhaften
Prozesses: 0x970 Startzeit der fehlerhaften Anwendung: 0x01cbfdf3955745a0 Pfad der
fehlerhaften Anwendung: E:\automatic shutdown\Auto Shutdown\AutoShutdown.exe Pfad
des fehlerhaften Moduls: C:\Windows\system32\KERNELBASE.dll Berichtskennung: e16cf660-69e6-11e0-9cc9-00038a000015
Error - 21.04.2011 17:10:53 | Computer Name = Alex-PC | Source = McLogEvent | ID = 5019
Description = Ausnahme in McShield.Exe! Ausnahme-Details folgen: VSCORE.14.2.0.794
Exception
Code : 0XC0000005 Exception Address : 0X1226C5D8 Exception Parameters :
2 Param 1 = 00000000 Param 2 = 0X016332BC More information : ScanRequest : NTName
is \Device\HarddiskVolume3\McAfee\MSC\mcscindx.dat.
Error - 21.04.2011 17:10:55 | Computer Name = Alex-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: mcshield.exe, Version: 14.2.0.794,
Zeitstempel: 0x4c1df0d1 Name des fehlerhaften Moduls: mcscan32.dll, Version: 5.400.0.1158,
Zeitstempel: 0x4a705d78 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0026c5d8 ID des fehlerhaften
Prozesses: 0x7a0 Startzeit der fehlerhaften Anwendung: 0x01cc0061215155e0 Pfad der
fehlerhaften Anwendung: C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
Pfad
des fehlerhaften Moduls: C:\Program Files\McAfee\VirusScan\Engine\5400.1158\mcscan32.dll
Berichtskennung:
d8328c50-6c5b-11e0-8a4b-00038a000015
Error - 21.04.2011 18:09:43 | Computer Name = Alex-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: explorer.exe, Version: 6.1.7600.16450,
Zeitstempel: 0x4aeba271 Name des fehlerhaften Moduls: uwinapi.dll_unloaded, Version:
0.0.0.0, Zeitstempel: 0x4834eda2 Ausnahmecode: 0xc0000005 Fehleroffset: 0x5f293caf
ID
des fehlerhaften Prozesses: 0x91c Startzeit der fehlerhaften Anwendung: 0x01cc006bb27a2dd0
Pfad
der fehlerhaften Anwendung: C:\Windows\explorer.exe Pfad des fehlerhaften Moduls:
uwinapi.dll Berichtskennung: 0eb7b9f0-6c64-11e0-981f-00038a000015
Error - 21.04.2011 18:45:07 | Computer Name = Alex-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7600.16450,
Zeitstempel: 0x4aeba271 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bdaae Ausnahmecode: 0xc06d007f Fehleroffset: 0x00009617 ID des fehlerhaften
Prozesses: 0x648 Startzeit der fehlerhaften Anwendung: 0x01cc0073d316ce60 Pfad der
fehlerhaften Anwendung: C:\Windows\Explorer.EXE Pfad des fehlerhaften Moduls: C:\Windows\system32\KERNELBASE.dll
Berichtskennung:
00c7e0e0-6c69-11e0-bc99-00038a000015
[ Media Center Events ]
Error - 23.11.2010 12:45:15 | Computer Name = Alex-PC | Source = MCUpdate | ID = 0
Description = 17:45:15 - Fehler beim Herstellen der Internetverbindung. 17:45:15
- Serververbindung konnte nicht hergestellt werden..
Error - 23.11.2010 12:45:23 | Computer Name = Alex-PC | Source = MCUpdate | ID = 0
Description = 17:45:20 - Fehler beim Herstellen der Internetverbindung. 17:45:20
- Serververbindung konnte nicht hergestellt werden..
Error - 10.01.2011 11:06:40 | Computer Name = Alex-PC | Source = MCUpdate | ID = 0
Description = 16:06:40 - Fehler beim Herstellen der Internetverbindung. 16:06:40
- Serververbindung konnte nicht hergestellt werden..
Error - 10.01.2011 11:07:14 | Computer Name = Alex-PC | Source = MCUpdate | ID = 0
Description = 16:07:09 - Fehler beim Herstellen der Internetverbindung. 16:07:09
- Serververbindung konnte nicht hergestellt werden..
[ System Events ]
Error - 18.03.2011 12:52:04 | Computer Name = ALEX-PC | Source = BugCheck | ID = 1001
Description =
Error - 19.03.2011 13:52:04 | Computer Name = Alex-PC | Source = Microsoft-Windows-HAL | ID = 12
Description = Der Speicher wurde beim letzten Leistungsübergang des Systems von
der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte
Firmware verfügbar ist.
Error - 20.03.2011 12:16:01 | Computer Name = Alex-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?20.?03.?2011 um 16:06:49 unerwartet heruntergefahren.
Error - 20.03.2011 12:16:08 | Computer Name = ALEX-PC | Source = BugCheck | ID = 1001
Description =
Error - 21.03.2011 10:05:36 | Computer Name = Alex-PC | Source = Microsoft-Windows-HAL | ID = 12
Description = Der Speicher wurde beim letzten Leistungsübergang des Systems von
der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte
Firmware verfügbar ist.
Error - 21.03.2011 16:58:25 | Computer Name = Alex-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?21.?03.?2011 um 21:57:29 unerwartet heruntergefahren.
Error - 21.03.2011 16:58:32 | Computer Name = Alex-PC | Source = BugCheck | ID = 1001
Description =
Error - 22.03.2011 12:41:10 | Computer Name = Alex-PC | Source = Microsoft-Windows-HAL | ID = 12
Description = Der Speicher wurde beim letzten Leistungsübergang des Systems von
der Plattformfirmware beschädigt. Überprüfen Sie, ob für Ihr System aktualisierte
Firmware verfügbar ist.
Error - 23.03.2011 17:11:00 | Computer Name = Alex-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?23.?03.?2011 um 22:09:27 unerwartet heruntergefahren.
Error - 23.03.2011 17:11:06 | Computer Name = Alex-PC | Source = BugCheck | ID = 1001
Description =
< End of report >
So, ich hoff das sind genug Logfiles und ihr könnt mir helfen, Danke im Voraus und frohe Ostern, Aligigan |
