Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Kein WLAN nach vermeintlicher Virenentfernung (Win XP) (https://www.trojaner-board.de/105524-kein-wlan-vermeintlicher-virenentfernung-win-xp.html)

cuyito 28.11.2011 17:45
Kein WLAN nach vermeintlicher Virenentfernung (Win XP)
 
Hallo,
es handelt sich um ein Dell Laptop, Windows XP, SP3, 1,7 GHz, 1GB RAM.
Beim Hochfahren wurde der IE geöffnet und konnte nur mit Alt+F4 geschlossen werden. Ansonsten ging auch nicht wirklich etwas, das System war superlangsam.
Unter msconfig habe ich das Häkchen beim Eintrag 0.46051591644591294. exe abgeklickt, Avira geupdatet, Spybot SD rüberlaufenlassen. Beide haben Schädlinge gefunden und entfernt, nämlich den TR/Spy.Banker.Gen2.
Nun ist dieser Eintrag im msconfig immer noch da, und das WLAN will einfach nicht. Internet über Kabel ist kein Problem.
Deffoger habe ich laufen lassen, das Programm hat aber nicht nach einem Neustart gefragt. Hab dann manuell neu gestartet. Hier die defogger_disable Log:
Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:30 on 28/11/2011 (moi)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
Hier der die otl.txt-Datei:
Code:
OTL logfile created on: 28.11.2011 15:13:53 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Documents and Settings\***\Bureau
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000100C | Country: Suisse | Language: FRS | Date Format: dd.MM.yyyy
 
1015.37 Mb Total Physical Memory | 284.40 Mb Available Physical Memory | 28.01% Memory free
2.38 Gb Paging File | 1.57 Gb Available in Paging File | 65.92% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.45 Gb Total Space | 3.47 Gb Free Space | 4.86% Space Free | Partition Type: NTFS
Drive F: | 7.45 Gb Total Space | 1.00 Gb Free Space | 13.45% Space Free | Partition Type: FAT32
 
Computer Name: ***| User Name: ***| Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.11.28 13:08:54 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\***\Bureau\OTL.exe
PRC - [2011.10.11 15:00:02 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2011.10.11 14:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011.10.11 14:59:37 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2011.10.11 14:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.09 13:06:06 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
PRC - [2008.04.14 03:34:03 | 001,037,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2006.03.03 20:03:10 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe
PRC - [2005.09.10 00:19:34 | 000,393,216 | ---- | M] (SigmaTel, Inc.) -- C:\WINDOWS\stsystra.exe
PRC - [2005.09.01 18:24:08 | 000,684,032 | ---- | M] () -- C:\Program Files\Dell\QuickSet\quickset.exe
PRC - [2005.07.19 16:32:18 | 000,221,184 | ---- | M] (Logitech Inc.) -- C:\WINDOWS\system32\LVCOMSX.EXE
PRC - [2005.06.10 11:44:02 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
PRC - [2004.08.05 13:00:00 | 000,047,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drwtsn32.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.11.27 19:19:48 | 001,166,288 | ---- | M] () -- C:\WINDOWS\system32\5050\components\AcroFF050.dll
MOD - [2011.10.11 14:59:51 | 000,398,288 | ---- | M] () -- C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
MOD - [2005.10.14 23:00:00 | 000,125,440 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll
MOD - [2005.09.01 18:24:08 | 000,684,032 | ---- | M] () -- C:\Program Files\Dell\QuickSet\quickset.exe
MOD - [2005.07.26 19:46:42 | 000,069,632 | ---- | M] () -- C:\Program Files\Dell\QuickSet\dadkeyb.dll
MOD - [2005.06.29 13:44:42 | 000,090,223 | ---- | M] () -- C:\Program Files\Dell\QuickSet\preflibcl.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled | Stopped] --  -- (HidServ)
SRV - File not found [On_Demand | Stopped] --  -- (AppMgmt)
SRV - [2011.10.11 14:59:49 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.10.11 14:59:37 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2006.03.03 20:03:10 | 000,069,632 | ---- | M] (HP) [Unknown | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
SRV - [2005.04.03 23:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [Disabled | Stopped] -- C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.10.11 15:00:01 | 000,134,344 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.10.11 15:00:01 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011.10.11 15:00:01 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2010.06.17 15:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010.02.11 13:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2008.04.13 19:56:06 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2008.04.13 19:53:09 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2007.01.18 15:28:02 | 000,005,275 | ---- | M] (Cisco Systems, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\CVirtA.sys -- (CVirtA)
DRV - [2006.11.28 22:46:24 | 000,028,224 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PDNMp50.sys -- (PDNMp50)
DRV - [2006.11.28 22:46:22 | 000,027,072 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PDNSp50.sys -- (PDNSp50)
DRV - [2005.09.10 00:15:32 | 001,032,472 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2005.08.05 04:32:16 | 000,045,312 | R--- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp)
DRV - [2005.08.03 11:44:16 | 000,016,128 | ---- | M] (Dell Inc) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS -- (APPDRV)
DRV - [2005.07.22 04:02:12 | 001,035,008 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2005.07.22 04:01:08 | 000,201,600 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2005.07.22 04:01:00 | 000,717,952 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2005.05.27 10:46:22 | 000,913,280 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV302AV.SYS -- (PID_08A0) QuickCam IM(PID_08A0)
DRV - [2005.05.27 10:38:00 | 000,007,136 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\lv302af.sys -- (pepifilter)
DRV - [2005.05.27 10:31:28 | 000,022,016 | R--- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2005.02.11 10:22:48 | 000,081,728 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750mgmt.sys -- (k750mgmt)
DRV - [2005.02.11 10:21:10 | 000,089,872 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750mdm.sys -- (k750mdm)
DRV - [2005.02.11 10:21:02 | 000,006,576 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750mdfl.sys -- (k750mdfl)
DRV - [2005.02.11 10:19:20 | 000,055,216 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750bus.sys -- (k750bus) Sony Ericsson 750 driver (WDM)
DRV - [2004.12.06 22:10:12 | 000,369,024 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2004.08.05 13:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2004.08.05 13:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.7
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.6.0.8312
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=12.0.1.669: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.669: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.669: c:\program files\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: C:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: C:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\***\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.10.05 16:56:49 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\WINDOWS\system32\5050 [2011.11.27 19:19:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.11.10 22:49:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.11.10 22:49:39 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\WINDOWS\system32\5050 [2011.11.27 19:19:48 | 000,000,000 | ---D | M]
 
[2008.09.19 17:46:46 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\***\Application Data\Mozilla\Extensions
[2011.11.10 19:07:04 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\***\Application Data\Mozilla\Firefox\Profiles\vwq3fdzl.default\extensions
[2010.08.11 12:27:22 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\***\Application Data\Mozilla\Firefox\Profiles\vwq3fdzl.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2007.06.04 01:09:00 | 000,002,386 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Mozilla\Firefox\Profiles\vwq3fdzl.default\searchplugins\siteadvisor.xml
[2008.06.19 06:03:11 | 000,001,108 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Mozilla\Firefox\Profiles\vwq3fdzl.default\searchplugins\wikipedia.xml
[2011.11.27 18:51:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011.11.27 18:51:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2011.11.27 19:19:48 | 000,000,000 | ---D | M] (Java String Helper) -- C:\WINDOWS\SYSTEM32\5050
[2011.11.05 08:18:04 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.11.27 18:51:03 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.11.05 05:13:41 | 000,001,516 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-france.xml
[2011.11.05 04:32:18 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011.11.05 05:13:41 | 000,001,822 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\cnrtl-tlfi-fr.xml
[2011.11.05 05:13:41 | 000,001,154 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-france.xml
[2011.11.05 05:13:41 | 000,001,426 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-fr.xml
[2011.11.05 05:13:41 | 000,000,956 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-france.xml
 
O1 HOSTS File: ([2009.04.11 17:16:52 | 000,000,176 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 189.126.110.166        www.bancoreal.com.br
O1 - Hosts: 189.126.110.166        www.rie.com.br
O1 - Hosts: 189.126.110.166        www.itau.com.br
O1 - Hosts: 189.126.110.166        www.itaupersonnalite.com.br
O2 - BHO: (Adobe PDF Reader Link Helper) - {C689C99E-3A8C-4c87-A79C-C80DC9C81632} - C:\WINDOWS\system32\AcroIEHelpe051.dll (Adobe Systems, Incorporated)
O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe ()
O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe (Logitech Inc.)
O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [LogitechSoftwareUpdate] C:\Program Files\Logitech\Video\ManifestEngine.exe (Logitech Inc.)
O4 - HKCU..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netwaiting.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe File not found
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKCU\..Trusted Domains: localhost ([]http in Intranet local)
O15 - HKCU\..Trusted Ranges: GD ([http] in Intranet local)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Fichiers communs\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) -C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\appconf32.exe) -C:\WINDOWS\system32\appconf32.exe ()
O24 - Desktop Components:0 (Ma page d'accueil) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\***\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\***\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {93994DE8-8239-4655-B1D1-5F4E91300429} - C:\Program Files\DVD-Tools\DVD Region-Free\DVDShell.dll (Fengtao Software)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004.08.20 11:37:16 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{29382eec-aad4-11da-b73d-00142298a631}\Shell\AutoRun\command - "" = .\Recycled\Driveinfo.exe
O33 - MountPoints2\{29382eec-aad4-11da-b73d-00142298a631}\Shell\Open\Command - "" = .\Recycled\Driveinfo.exe
O33 - MountPoints2\{2a17f68c-883e-11db-b8c7-00142298a631}\Shell\AutoRun\command - "" = .\Recycled\Driveinfo.exe
O33 - MountPoints2\{2a17f68c-883e-11db-b8c7-00142298a631}\Shell\Open\Command - "" = .\Recycled\Driveinfo.exe
O33 - MountPoints2\{39dc9324-fa59-11dc-b9c3-00142298a631}\Shell - "" = AutoRun
O33 - MountPoints2\{39dc9324-fa59-11dc-b9c3-00142298a631}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{6f6438f0-d886-11de-bad2-00142298a631}\Shell - "" = AutoRun
O33 - MountPoints2\{6f6438f0-d886-11de-bad2-00142298a631}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Sys.exe
O33 - MountPoints2\{75c85f0e-18e5-11e1-bc55-00142298a631}\Shell - "" = AutoRun
O33 - MountPoints2\{75c85f0e-18e5-11e1-bc55-00142298a631}\Shell\AutoRun\command - "" = E:\Install.exe
O33 - MountPoints2\{aba32032-9505-11db-b8d2-00142298a631}\Shell\Setup\command - "" = C:\WINDOWS\System32\setup.exe -- [2008.04.14 03:34:21 | 000,023,040 | ---- | M] (Microsoft Corporation)
O33 - MountPoints2\{b4a15da7-f93b-11dd-ba5b-00142298a631}\Shell - "" = AutoRun
O33 - MountPoints2\{b4a15da7-f93b-11dd-ba5b-00142298a631}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE      .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
O33 - MountPoints2\{bcf35456-1a92-11dd-b9d7-00142298a631}\Shell\AutoRun\command - "" = setupSNK.exe
O33 - MountPoints2\{c244c54e-7bfe-11dc-b95f-00142298a631}\Shell - "" = AutoRun
O33 - MountPoints2\{c244c54e-7bfe-11dc-b95f-00142298a631}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {0fde1f56-0d59-4fd7-9624-e3df6b419d0f} - IEEX
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Rendu VML (Vector Graphics Rendering)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Liaison de données Dynamic HTML pour Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Création avancée
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - Classes Java DirectAnimation
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - Windows Messenger 5.1
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
ActiveX: {9A394342-4A68-4EBA-85A6-55B559F4E700} - .NET Framework
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Planificateur de tâches
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EFCE7BE0-510E-4932-9475-F44CD90DE16A} - Microsoft .NET Framework 1.1 Security Update (KB2572067)
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
ActiveX: >{B271CFE5-41FE-4B2C-9731-05E5CABF2C38} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
NetSvcs: AppMgmt -  File not found
NetSvcs: HidServ -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
MsConfig - Services: "JavaQuickStarterService"
MsConfig - Services: "IDriverT"
MsConfig - Services: "GoogleDesktopManager-051210-111108"
MsConfig - StartUpFolder: C:^Documents and Settings^***^Menu Démarrer^Programmes^Démarrage^0.46051591644591294.exe.lnk -  - File not found
MsConfig - StartUpReg: CTFMON.EXE - hkey= - key= -  File not found
MsConfig - StartUpReg: Google Desktop Search - hkey= - key= - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (Google)
MsConfig - StartUpReg: LogitechVideoTray - hkey= - key= - C:\Program Files\Logitech\Video\LogiTray.exe (Logitech Inc.)
MsConfig - StartUpReg: NeroFilterCheck - hkey= - key= -  File not found
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= -  File not found
MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
MsConfig - State: "system.ini" - 0
MsConfig - State: "win.ini" - 0
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 2
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.11.28 14:56:51 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\***\Bureau\OTL.exe
[2011.11.28 12:58:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\xmldm
[2011.11.27 19:38:09 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\***\Recent
[2011.11.27 19:19:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\5050
[2011.11.27 19:19:46 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\***\IECompatCache
[2011.11.27 18:51:41 | 000,000,000 | ---D | C] -- C:\Program Files\Fichiers communs\Java
[2011.11.27 18:12:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2011.11.27 17:47:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\***\Application Data\Avira
[2011.11.27 17:46:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Avira
[2011.11.27 17:45:49 | 000,134,344 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys
[2011.11.27 17:45:49 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys
[2011.11.27 17:45:49 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avkmgr.sys
[2011.11.27 17:45:14 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2011.11.27 17:45:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Avira
[2011.11.27 16:47:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2011.11.27 16:16:34 | 000,000,000 | ---D | C] -- C:\5da908ee39ecc65f8f6b217aefba
[2011.11.27 14:32:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\CCleaner
[2011.11.26 18:51:09 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\UAs
[2011.11.23 19:05:15 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.11.23 19:01:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\5048
[2011.11.22 17:18:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\5047
[2011.11.21 15:54:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\5045
[2011.11.21 08:11:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\components
[2011.11.20 16:01:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\5044
[2011.11.20 16:01:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\kock
[2011.11.10 09:54:17 | 000,000,000 | ---D | C] -- C:\7262946036c5b3ca445270
[72 C:\*.tmp files -> C:\*.tmp -> ]
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.11.28 13:35:14 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.11.28 13:34:57 | 000,000,274 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-989992746-142525385-947072614-1006.job
[2011.11.28 13:34:07 | 1064,763,392 | -HS- | M] () -- C:\hiberfil.sys
[2011.11.28 13:34:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.11.28 13:28:45 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\***\defogger_reenable
[2011.11.28 13:08:54 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\***\Bureau\OTL.exe
[2011.11.28 13:08:36 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\***\Bureau\Defogger.exe
[2011.11.27 21:05:41 | 000,188,200 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.11.27 19:19:39 | 000,000,072 | ---- | M] () -- C:\WINDOWS\System32\blckdom.res
[2011.11.27 18:37:50 | 000,512,978 | ---- | M] () -- C:\WINDOWS\System32\perfh00C.dat
[2011.11.27 18:37:50 | 000,443,248 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.11.27 18:37:50 | 000,086,282 | ---- | M] () -- C:\WINDOWS\System32\perfc00C.dat
[2011.11.27 18:37:50 | 000,072,514 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.11.27 16:49:56 | 000,000,216 | RHS- | M] () -- C:\boot.ini
[2011.11.23 19:28:39 | 000,069,120 | ---- | M] () -- C:\Documents and Settings\***\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.11.23 19:13:36 | 000,000,282 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-989992746-142525385-947072614-1006.job
[2011.11.22 18:43:09 | 000,015,409 | ---- | M] () -- C:\Documents and Settings\***\Bureau\trucs a faire.ods
[2011.11.22 17:44:12 | 000,000,068 | ---- | M] () -- C:\WINDOWS\DVDRegionFree.INI
[2011.11.20 18:58:22 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011.11.12 18:33:35 | 000,017,408 | ---- | M] () -- C:\Documents and Settings\***\Local Settings\Application Data\WebpageIcons.db
[2011.11.12 16:47:19 | 000,073,438 | ---- | M] () -- C:\Documents and Settings\***\Mes documents\modul_dolm.pdf
[2011.11.11 18:40:04 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011.11.10 22:49:57 | 000,000,758 | ---- | M] () -- C:\Documents and Settings\***\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011.11.10 22:49:57 | 000,000,740 | ---- | M] () -- C:\Documents and Settings\All Users\Bureau\Mozilla Firefox.lnk
[2011.11.10 10:15:10 | 000,002,607 | ---- | M] () -- C:\Documents and Settings\***\Mes documents\a faire.rtf
[2011.11.09 11:26:21 | 000,191,455 | ---- | M] () -- C:\Documents and Settings\***\Mes documents\Tour Manager Application Form.pdf
[2011.11.08 09:23:19 | 000,087,448 | ---- | M] () -- C:\Documents and Settings\***\Mes documents\Tour Manager Application Form.odt
[2011.11.07 19:35:18 | 000,086,240 | ---- | M] () -- C:\Documents and Settings\***\Mes documents\Tour Manager Application Form 2012.odt
[2011.11.07 19:06:02 | 000,087,384 | ---- | M] () -- C:\Documents and Settings\***\Mes documents\Tour Manager Application wesley.odt
[2011.11.07 16:37:44 | 000,017,493 | ---- | M] () -- C:\Documents and Settings\***\Mes documents\stalin architcture.odt
[2011.11.07 09:59:49 | 000,010,080 | ---- | M] () -- C:\Documents and Settings\***\Mes documents\ebay2.pdf
[2011.11.07 09:47:00 | 000,010,104 | ---- | M] () -- C:\Documents and Settings\***\Mes documents\ebay.pdf
[2011.11.05 18:14:30 | 000,029,734 | ---- | M] () -- C:\Documents and Settings\***\Mes documents\TD Application Letter Lucerne.pdf
[2011.11.03 13:55:32 | 000,014,554 | ---- | M] () -- C:\Documents and Settings\***\Mes documents\denise train applic.odt
[2011.11.02 21:44:59 | 000,069,859 | ---- | M] () -- C:\Documents and Settings\***\Mes documents\dm-Digifoto.pdf
[2011.10.30 15:13:53 | 000,010,810 | ---- | M] () -- C:\Documents and Settings\***\Mes documents\Tour liste.ods
[72 C:\*.tmp files -> C:\*.tmp -> ]
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.11.28 13:28:45 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\***\defogger_reenable
[2011.11.28 13:26:39 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\***\Bureau\Defogger.exe
[2011.11.27 21:05:41 | 000,188,200 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011.11.27 16:15:12 | 000,001,950 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Windows Messenger.lnk
[2011.11.26 18:49:03 | 1064,763,392 | -HS- | C] () -- C:\hiberfil.sys
[2011.11.20 16:01:30 | 000,000,072 | ---- | C] () -- C:\WINDOWS\System32\blckdom.res
[2011.11.12 16:47:18 | 000,073,438 | ---- | C] () -- C:\Documents and Settings\***\Mes documents\modul_dolm.pdf
[2011.11.10 22:49:56 | 000,000,746 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Mozilla Firefox.lnk
[2011.11.09 11:26:19 | 000,191,455 | ---- | C] () -- C:\Documents and Settings\***\Mes documents\Tour Manager Application Form.pdf
[2011.11.08 09:17:35 | 000,087,448 | ---- | C] () -- C:\Documents and Settings\***\Mes documents\Tour Manager Application Form.odt
[2011.11.07 19:06:01 | 000,087,384 | ---- | C] () -- C:\Documents and Settings\***\Mes documents\Tour Manager Application wesley.odt
[2011.11.07 16:37:42 | 000,017,493 | ---- | C] () -- C:\Documents and Settings\***\Mes documents\stalin architcture.odt
[2011.11.07 09:59:49 | 000,010,080 | ---- | C] () -- C:\Documents and Settings\***\Mes documents\ebay2.pdf
[2011.11.07 09:47:00 | 000,010,104 | ---- | C] () -- C:\Documents and Settings\***\Mes documents\ebay.pdf
[2011.11.05 18:14:30 | 000,029,734 | ---- | C] () -- C:\Documents and Settings\***\Mes documents\TD Application Letter Lucerne.pdf
[2011.11.04 08:46:38 | 000,086,240 | ---- | C] () -- C:\Documents and Settings\***\Mes documents\Tour Manager Application Form 2012.odt
[2011.11.03 13:35:56 | 000,014,554 | ---- | C] () -- C:\Documents and Settings\***\Mes documents\denise train applic.odt
[2011.11.02 21:44:59 | 000,069,859 | ---- | C] () -- C:\Documents and Settings\***\Mes documents\dm-Digifoto.pdf
[2011.10.04 18:09:51 | 000,017,408 | ---- | C] () -- C:\Documents and Settings\***\Local Settings\Application Data\WebpageIcons.db
[2011.01.03 12:34:05 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010.12.18 11:11:04 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2010.12.01 14:04:50 | 000,131,775 | ---- | C] () -- C:\Documents and Settings\***\Application Data\mdbu.bin
[2010.09.07 08:12:37 | 000,097,720 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2009.08.19 13:05:04 | 000,442,368 | R--- | C] () -- C:\WINDOWS\System32\ZSHP1018.EXE
[2009.08.19 13:05:04 | 000,106,496 | R--- | C] () -- C:\WINDOWS\System32\VSHP1018.DLL
[2008.12.09 16:23:13 | 000,050,240 | RHS- | C] () -- C:\WINDOWS\System32\appconf32.exe
[2008.03.04 10:14:46 | 000,000,305 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\addr_file.html
[2008.02.02 17:33:40 | 000,000,126 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2007.07.21 18:22:09 | 000,000,031 | ---- | C] () -- C:\WINDOWS\wwwbatch.ini
[2007.07.21 18:22:04 | 000,045,056 | ---- | C] () -- C:\WINDOWS\wsutil.exe
[2007.07.21 18:19:30 | 000,172,032 | ---- | C] () -- C:\WINDOWS\WsBtn.dll
[2006.10.12 22:04:02 | 000,002,189 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006.09.26 18:14:40 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2006.09.21 17:36:30 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\instlsp.exe
[2006.04.09 13:08:25 | 000,009,255 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2006.04.09 13:02:19 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\InstMed.exe
[2006.04.09 13:00:42 | 000,081,920 | R--- | C] () -- C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
[2006.04.03 19:08:08 | 000,006,580 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2006.04.03 19:08:08 | 000,000,104 | RHS- | C] () -- C:\WINDOWS\System32\FB5028971B.sys
[2006.03.31 14:16:23 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006.03.30 23:26:30 | 000,000,118 | ---- | C] () -- C:\WINDOWS\DVDFab.INI
[2006.03.22 17:31:25 | 000,107,132 | ---- | C] () -- C:\WINDOWS\UninstallThunderbird.exe
[2006.03.22 17:29:09 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2006.03.22 17:29:00 | 000,107,132 | ---- | C] () -- C:\WINDOWS\UninstallFirefox.exe
[2006.03.22 17:28:48 | 000,007,562 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2006.03.08 13:21:19 | 000,000,068 | ---- | C] () -- C:\WINDOWS\DVDRegionFree.INI
[2006.03.07 18:08:57 | 000,001,027 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006.03.03 18:34:41 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2006.03.03 18:17:18 | 000,069,120 | ---- | C] () -- C:\Documents and Settings\***\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006.02.28 13:20:10 | 000,000,126 | ---- | C] () -- C:\Documents and Settings\***\Local Settings\Application Data\fusioncache.dat
[2006.02.14 18:45:34 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006.02.14 18:35:26 | 000,000,004 | -H-- | C] () -- C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare
[2006.02.14 18:34:47 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\AegisI5.exe
[2006.02.14 18:34:47 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\WLTRYSVC.EXE
[2006.02.14 18:13:02 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe
[2006.02.14 18:12:26 | 000,000,536 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2006.01.04 10:12:04 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\HPZIDS01.dll
[2004.08.20 11:45:35 | 000,000,829 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004.08.20 11:40:52 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004.08.20 11:35:13 | 000,021,892 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004.08.20 11:34:09 | 000,003,712 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004.08.20 11:30:35 | 000,004,205 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004.08.20 11:24:14 | 000,512,978 | ---- | C] () -- C:\WINDOWS\System32\perfh00C.dat
[2004.08.20 11:24:14 | 000,322,810 | ---- | C] () -- C:\WINDOWS\System32\perfi00C.dat
[2004.08.20 11:24:14 | 000,086,282 | ---- | C] () -- C:\WINDOWS\System32\perfc00C.dat
[2004.08.20 11:24:14 | 000,034,108 | ---- | C] () -- C:\WINDOWS\System32\perfd00C.dat
[2004.08.20 11:24:02 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.08.20 11:24:00 | 000,443,248 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004.08.20 11:24:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004.08.20 11:24:00 | 000,072,514 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004.08.20 11:24:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004.08.20 11:23:58 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004.08.20 11:23:58 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004.08.20 11:23:56 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004.08.20 11:23:51 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004.08.20 11:23:51 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004.08.20 11:23:45 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004.08.20 11:23:36 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2002.09.18 00:45:00 | 000,119,808 | ---- | C] () -- C:\WINDOWS\lsb_un20.exe
[2001.07.07 02:00:00 | 000,003,279 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
[1999.01.27 12:39:06 | 000,065,024 | ---- | C] () -- C:\WINDOWS\System32\indounin.dll
[1997.06.13 06:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll
 
========== LOP Check ==========
 
[2010.12.01 13:49:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\COOP Service Photo
[2006.11.10 13:52:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\.BitTornado
[2011.10.26 16:59:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Cocoon Software
[2010.09.05 17:57:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\EA
[2011.11.27 14:42:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\FrostWire
[2006.11.13 19:38:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Image Zone Express
[2006.02.28 13:44:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Template
[2006.03.22 17:31:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\Thunderbird
[2006.06.24 23:24:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\***\Application Data\VoipStunt
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2006.11.16 10:57:14 | 000,000,000 | ---D | M] -- C:\50d641fcfa204484a7
[2011.11.27 16:16:34 | 000,000,000 | ---D | M] -- C:\5da908ee39ecc65f8f6b217aefba
[2011.11.10 09:54:35 | 000,000,000 | ---D | M] -- C:\7262946036c5b3ca445270
[2011.11.27 19:30:24 | 000,000,000 | -H-D | M] -- C:\Config.Msi
[2006.03.07 20:39:29 | 000,000,000 | ---D | M] -- C:\dell
[2011.11.23 10:14:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings
[2006.02.14 18:13:10 | 000,000,000 | ---D | M] -- C:\drivers
[2006.10.18 14:59:37 | 000,000,000 | ---D | M] -- C:\DVDFab_Temp
[2006.03.07 17:12:50 | 000,000,000 | ---D | M] -- C:\i386
[2011.11.28 12:58:06 | 000,000,000 | R--D | M] -- C:\Program Files
[2011.11.23 19:07:42 | 000,000,000 | -HSD | M] -- C:\RECYCLER
[2011.11.28 12:34:34 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.11.28 13:34:48 | 000,000,000 | ---D | M] -- C:\WINDOWS
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: LOCALAPPDATA
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.manifest /3 >
[6 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
 
 
< MD5 for: EXPLORER.EXE  >
[2007.06.13 14:10:53 | 001,037,312 | ---- | M] (Microsoft Corporation) MD5=B795475444D6D57A572C14B9E1A29839 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007.06.13 14:22:28 | 001,037,312 | ---- | M] (Microsoft Corporation) MD5=D0288319660EDCFED07C7E74C4EA38A5 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2008.04.14 03:34:03 | 001,037,824 | ---- | M] (Microsoft Corporation) MD5=F2317622D29F9FF0F88AEECD5F60F0DD -- C:\WINDOWS\explorer.exe
[2008.04.14 03:34:03 | 001,037,824 | ---- | M] (Microsoft Corporation) MD5=F2317622D29F9FF0F88AEECD5F60F0DD -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2004.08.05 13:00:00 | 000,153,088 | ---- | M] (Microsoft Corporation) MD5=47D9746DB5064D95DFB0E4D88A10C540 -- C:\i386\REGEDIT.EXE
[2004.08.05 13:00:00 | 000,153,088 | ---- | M] (Microsoft Corporation) MD5=47D9746DB5064D95DFB0E4D88A10C540 -- C:\WINDOWS\$NtServicePackUninstall$\regedit.exe
[2008.04.14 03:34:19 | 000,153,088 | ---- | M] (Microsoft Corporation) MD5=ADF88D0996A634B5B13EE8FB9595647D -- C:\WINDOWS\regedit.exe
[2008.04.14 03:34:19 | 000,153,088 | ---- | M] (Microsoft Corporation) MD5=ADF88D0996A634B5B13EE8FB9595647D -- C:\WINDOWS\ServicePackFiles\i386\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2004.08.05 13:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D6D65EA32B190401B57EDB6706F29669 -- C:\i386\userinit.exe
[2004.08.05 13:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D6D65EA32B190401B57EDB6706F29669 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008.04.14 03:34:26 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=E74DDB12188C2FF57A78624DBF7332FC -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 03:34:26 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=E74DDB12188C2FF57A78624DBF7332FC -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004.08.05 13:00:00 | 000,506,368 | ---- | M] (Microsoft Corporation) MD5=D2DE785AEAB0BB8CA4C14A8A199DBE4E -- C:\i386\winlogon.exe
[2004.08.05 13:00:00 | 000,506,368 | ---- | M] (Microsoft Corporation) MD5=D2DE785AEAB0BB8CA4C14A8A199DBE4E -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 03:34:28 | 000,512,000 | ---- | M] (Microsoft Corporation) MD5=DD73D6B9F6B4CB630CF35B438B540174 -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 03:34:28 | 000,512,000 | ---- | M] (Microsoft Corporation) MD5=DD73D6B9F6B4CB630CF35B438B540174 -- C:\WINDOWS\system32\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Kmode: %SystemRoot%\system32\win32k.sys [2011.09.06 15:10:01 | 001,859,072 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-11-11 21:50:25

< End of report >
und die Extras.txt:
Code:
OTL Extras logfile created on: 28.11.2011 15:13:53 - Run 1
OTL by OldTimer - Version 3.2.31.0    Folder = C:\Documents and Settings\***\Bureau
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000100C | Country: Suisse | Language: FRS | Date Format: dd.MM.yyyy
 
1015.37 Mb Total Physical Memory | 284.40 Mb Available Physical Memory | 28.01% Memory free
2.38 Gb Paging File | 1.57 Gb Available in Paging File | 65.92% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 71.45 Gb Total Space | 3.47 Gb Free Space | 4.86% Space Free | Partition Type: NTFS
Drive F: | 7.45 Gb Total Space | 1.00 Gb Free Space | 13.45% Space Free | Partition Type: FAT32
 
Computer Name: DENISE | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\MSN Messenger\msncall.exe" = C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire
"C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe" = C:\Program Files\VoipStunt.com\VoipStunt\VoipStunt.exe:*:Enabled:VoipStunt
"C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"C:\Program Files\MSN Messenger\msncall.exe" = C:\Program Files\MSN Messenger\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)
"C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe
"C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe
"C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe
"C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe" = C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe
"C:\Program Files\HP\Digital Imaging\bin\hposid01.exe" = C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe
"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe
"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe
"C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe
"C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe" = C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe
"C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe
"C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe
"C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe" = C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe
"C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe" = C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe
"C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe
"C:\Program Files\BitTornado\btdownloadgui.exe" = C:\Program Files\BitTornado\btdownloadgui.exe:*:Enabled:btdownloadgui -- ()
"C:\Program Files\Soulseek\slsk.exe" = C:\Program Files\Soulseek\slsk.exe:*:Enabled:SoulSeek
"C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" = C:\Program Files\Veoh Networks\Veoh\VeohClient.exe:*:Enabled:Veoh Client
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)
"C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager
"C:\Program Files\FrostWire\FrostWire.exe" = C:\Program Files\FrostWire\FrostWire.exe:*:Enabled:FrostWire -- (FrostWire Group)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F528948-0E80-4C96-B455-DE4167CB1DF7}" = Gestion de l'alimentation de la carte réseau interne
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Outil de téléchargement Windows Live
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216029FF}" = Java(TM) 6 Update 29
"{26E1BFB0-E87E-4696-9F89-B467F01F81E5}" = Broadcom Management Programs
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{350C940c-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{46ABBC54-1872-4AA3-95E2-F2C063A63F31}" = Installation Windows Live
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{5B6BE547-21E2-49CA-B2E2-6A5F470593B1}" = Sonic Activation Module
"{66910000-8B30-4973-A159-6371345AFFA5}" = WebReg
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{76EA55BD-535F-4AB4-AD80-A8CA331F4E6F}" = Windows Messenger 5.1
"{770F1BEC-2871-4E70-B837-FB8525FFA3B1}" = Windows Live Messenger
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{82C7B308-0BDD-49D8-8EA5-9CD3A3F9DF41}" = Windows Live Call
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8A4CE7FD-9657-4B06-9943-E1819F3D5D67}" = DocProc
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver for Mobile
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A394342-4A68-4EBA-85A6-55B559F4E700}" = Microsoft .NET Framework 1.1 French Language Pack
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{B131E59D-202C-43C6-84C9-68F0C37541F1}" = Galerie de photos Windows Live
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C41F4616-44B6-4E8D-BFC7-4267862A2CE1}" = DMX Update
"{C43048A9-742C-4DAD-90D2-E3B53C9DB825}" = Logiciel QuickCam de Logitech
"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D050D7362D214723AD585B541FFB6C11}" = DivX Content Uploader
"{D2988E9B-C73F-422C-AD4B-A66EBE257120}" = MCU
"{DCE8CD14-FBF5-4464-B9A4-E18E473546C7}" = Assistant de connexion Windows Live
"{E2C356F6-84B5-4CCB-8FED-12E0F1C2E97B}" = OpenOffice.org 2.0
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Alice" = Alice-Installationsdateien entfernen
"Avira AntiVir Desktop" = Avira Free Antivirus
"BitTornado" = BitTornado 0.3.17
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"CCleaner" = CCleaner
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3" = Conexant HDA D110 MDC V.92 Modem
"COOP Service Photo_is1" = COOP Service Photo 2.6
"Creative Removable Disk Manager" = Gestionnaire de disques amovible Creative
"DVD Region-Free_is1" = DVD Region-Free 3.25
"DVD SuperPack (DVD Region-Free, DVDFab and UltraDVD)_is1" = DVD SuperPack (DVD Region-Free, DVDFab and UltraDVD)
"DVDFab_is1" = DVDFab 1.50 Beta1 English Version
"FrostWire" = FrostWire 4.21.3
"Google Desktop" = Google Desktop
"HP-LaserJet 1018" = LaserJet 1018
"HPOCR" = OCR Software by I.R.I.S 7.0
"ie8" = Windows Internet Explorer 8
"IrfanView" = IrfanView (remove only)
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 8.0 (x86 fr)" = Mozilla Firefox 8.0 (x86 fr)
"Mozilla Thunderbird (1.5)" = Mozilla Thunderbird (1.5)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Nero - Burning Rom!UninstallKey" = Nero 6
"PhotoFiltre" = PhotoFiltre
"QcDrv" = Programme de gestion Camera de Logitech®
"RealPlayer 12.0" = RealPlayer
"Recuva" = Recuva
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Veetle TV" = Veetle TV 0.9.18
"VLC media player" = VLC media player 1.0.1
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Lecteur Windows Media 11
"Windows XP Service" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Installation Windows Live
"WinRAR archiver" = Archiveur WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Zattoo4" = Zattoo4 4.0.5
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"QUICKMEDIACONVERTER" = Quick Media Converter
"UnityWebPlayer" = Unity Web Player
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 27.11.2011 13:23:21 | Computer Name = DENISE | Source = MsiInstaller | ID = 10005
Description = Produit : Microsoft .NET Framework 3.5 SP1 -- Windows Installer a
rencontré une erreur inattendue lors de l'installation de ce package. Il s'agit
peut-être d'un problème lié au package. Le code d'erreur est 2203. Les arguments
 sont : c:\WINDOWS\Installer\24c8d.ipi, -2147024873,
 
Error - 27.11.2011 13:23:22 | Computer Name = DENISE | Source = MsiInstaller | ID = 1023
Description = Produit : Microsoft .NET Framework 3.5 SP1 - La mise à jour 'KB2416473'
 n'a pas pu être installée. Code d'erreur 1603.  Des informations supplémentaires
 sont disponibles dans le fichier journal C:\DOCUME~1\***\LOCALS~1\Temp\Microsoft
 .NET Framework 3.5-KB2416473_20111127_172236437-Msi0.txt.
 
Error - 27.11.2011 13:23:29 | Computer Name = *** | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 3.5-kb2416473,
 P2 1036, P3 1603, P4 msi, P5 f, P6 9.0.40215.0, P7 install, P8 x86, P9 xp, P10
2203.
 
Error - 27.11.2011 13:26:46 | Computer Name = *** | Source = HotFixInstaller | ID = 5000
Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb2478656,
 P2 1036, P3 1605, P4 msi, P5 f, P6 9.0.40302.0, P7 install, P8 x86, P9 xp, P10
0.
 
Error - 27.11.2011 13:32:06 | Computer Name = *** | Source = MsiInstaller | ID = 11500
Description = Produit : Java(TM) 6 Update 29 -- Erreur 1500. Une autre installation
 est en cours. Vous devez la terminer avant de poursuivre cette installation.
 
Error - 27.11.2011 13:34:30 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Application défaillante setup.exe, version 0.0.0.0, module défaillant
 kernel32.dll, version 5.1.2600.5781, adresse de défaillance 0x00012afb.
 
Error - 27.11.2011 13:35:37 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Application défaillante drwtsn32.exe, version 5.1.2600.0, module défaillant
 dbghelp.dll, version 5.1.2600.5512, adresse de défaillance 0x0001295d.
 
Error - 27.11.2011 13:42:16 | Computer Name = *** | Source = Application Hang | ID = 1002
Description = Application bloquée Setup.exe, version 0.0.0.0, module bloqué hungapp,
 version 0.0.0.0, adresse de blocage 0x00000000.
 
Error - 28.11.2011 09:52:29 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Application défaillante explorer.exe, version 6.0.2900.5512, module
 défaillant , version 0.0.0.0, adresse de défaillance 0x00000000.
 
Error - 28.11.2011 09:52:53 | Computer Name = *** | Source = Application Error | ID = 1000
Description = Application défaillante drwtsn32.exe, version 5.1.2600.0, module défaillant
 dbghelp.dll, version 5.1.2600.5512, adresse de défaillance 0x0001295d.
 
[ System Events ]
Error - 28.11.2011 07:26:11 | Computer Name = *** | Source = Disk | ID = 262151
Description = Le périphérique \Device\Harddisk0\D comporte un bloc défectueux.
 
Error - 28.11.2011 07:26:13 | Computer Name = *** | Source = Disk | ID = 262151
Description = Le périphérique \Device\Harddisk0\D comporte un bloc défectueux.
 
Error - 28.11.2011 07:26:16 | Computer Name = *** | Source = Disk | ID = 262151
Description = Le périphérique \Device\Harddisk0\D comporte un bloc défectueux.
 
Error - 28.11.2011 07:26:18 | Computer Name = *** | Source = Disk | ID = 262151
Description = Le périphérique \Device\Harddisk0\D comporte un bloc défectueux.
 
Error - 28.11.2011 07:26:21 | Computer Name = *** | Source = Disk | ID = 262151
Description = Le périphérique \Device\Harddisk0\D comporte un bloc défectueux.
 
Error - 28.11.2011 07:26:54 | Computer Name = *** | Source = DCOM | ID = 10010
Description = Le serveur {D61A27C6-8F53-11D0-BFA0-00A024151983} ne s'est pas enregistré
 sur DCOM avant la fin du temps imparti.
 
Error - 28.11.2011 07:58:41 | Computer Name = *** | Source = Disk | ID = 262151
Description = Le périphérique \Device\Harddisk0\D comporte un bloc défectueux.
 
Error - 28.11.2011 07:58:44 | Computer Name = *** | Source = Disk | ID = 262151
Description = Le périphérique \Device\Harddisk0\D comporte un bloc défectueux.
 
Error - 28.11.2011 09:54:46 | Computer Name = *** | Source = Disk | ID = 262151
Description = Le périphérique \Device\Harddisk0\D comporte un bloc défectueux.
 
Error - 28.11.2011 10:26:24 | Computer Name = *** | Source = Disk | ID = 262151
Description = Le périphérique \Device\Harddisk0\D comporte un bloc défectueux.
 
 
< End of report >
Beim GMER-Scan war nach ca. 1 Stunde ein Bluescreen (DRIVER_IRQL_NOT_LESS_OR_EQUAL ***STOP: 0x000000D1 (0x00001210, 0x00000005, 0x00000000, 0xF7494D26) ***atapi.sys - Adress F7494D26 base at F748F000, DateStamp 4802539d). Nach Neustart habe ich den Scan nochmals ausgeführt. Und nach einer Stunde wieder derselbe BSOD. Also hab ichs gelassen :/

Ich hoffe, die Infos sind erstmal hilfreich..
Gruß + Danke schonmal,

cuy

markusg 28.11.2011 17:51
ich sehe es mir an.

markusg 28.11.2011 17:57
hi

achtung!
dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



Code:
:OTL
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\appconf32.exe) -C:\WINDOWS\system32\appconf32.exe ()
[2011.11.28 12:58:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\xmldm
[2011.11.27 19:19:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\5050
[2011.11.23 19:01:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\5048
[2011.11.22 17:18:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\5047
[2011.11.21 15:54:38 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\5045
[2011.11.20 16:01:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\5044
[2011.11.20 16:01:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\kock
[2011.11.20 16:01:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\kock
[2011.11.10 09:54:17 | 000,000,000 | ---D | C] -- C:\7262946036c5b3ca445270
:Files
C:\WINDOWS\system32\appconf32.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]


• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.

öffne arbeitsplatz, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
folge dem link, und lade das archiv im upload channel hoch
http://www.trojaner-board.de/54791-a...ner-board.html

cuyito 28.11.2011 18:25
hallo und danke!
hier die .log:
Code:
All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\WINDOWS\system32\appconf32.exe deleted successfully.
File \WINDOWS\system32\appconf32.exe) -C:\WINDOWS\system32\appconf32.exe not found.
C:\WINDOWS\System32\xmldm folder moved successfully.
C:\WINDOWS\System32\5050\components folder moved successfully.
C:\WINDOWS\System32\5050 folder moved successfully.
C:\WINDOWS\System32\5048\components folder moved successfully.
C:\WINDOWS\System32\5048 folder moved successfully.
C:\WINDOWS\System32\5047\components folder moved successfully.
C:\WINDOWS\System32\5047 folder moved successfully.
C:\WINDOWS\System32\5045\components folder moved successfully.
C:\WINDOWS\System32\5045 folder moved successfully.
C:\WINDOWS\System32\5044\components folder moved successfully.
C:\WINDOWS\System32\5044 folder moved successfully.
C:\WINDOWS\System32\kock folder moved successfully.
Folder C:\WINDOWS\System32\kock\ not found.
C:\7262946036c5b3ca445270 folder moved successfully.
========== FILES ==========
File move failed. C:\WINDOWS\system32\appconf32.exe scheduled to be moved on reboot.
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: Administrateur
->Flash cache emptied: 419 bytes
 
User: All Users
 
User: Default User
 
User: LocalService
->Flash cache emptied: 348 bytes
 
User: ***
->Flash cache emptied: 487 bytes
 
User: NetworkService
 
Total Flash Files Cleaned = 0.00 mb
 
 
[EMPTYTEMP]
 
User: Administrateur
->Temp folder emptied: 16712456 bytes
->Temporary Internet Files folder emptied: 276990 bytes
->FireFox cache emptied: 6026873 bytes
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
 
User: LocalService
->Temp folder emptied: 115616 bytes
->Temporary Internet Files folder emptied: 49554 bytes
->FireFox cache emptied: 828798 bytes
->Flash cache emptied: 0 bytes
 
User: ***
->Temp folder emptied: 83450062 bytes
->Temporary Internet Files folder emptied: 5625469 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 44676672 bytes
->Flash cache emptied: 0 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 1738670 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 3614355 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 33432 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 70237140 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 265818947 bytes
 
Total Files Cleaned = 476.00 mb
 
 
OTL by OldTimer - Version 3.2.31.0 log created on 11282011_181132

Files\Folders moved on Reboot...
C:\WINDOWS\system32\appconf32.exe moved successfully.

Registry entries deleted on Reboot...
Die MovedFiles lad ich sofort rauf.

--cuy

markusg 28.11.2011 18:33
ok dann warte ich mal auf den upload :-)

cuyito 28.11.2011 18:47
...ich bin mir nicht sicher wie das funktioniert, habs aber nun hochgeladen...

markusg 28.11.2011 18:49
nichts angekommen
File-Upload.net - Ihr kostenloser File Hoster!
dort hochladen
link als private nachicht an mich

markusg 28.11.2011 19:04
hi
nutzt du das system für onlinebanking einkäufe oder sonst was wichtiges, wie zb berufliches?

cuyito 28.11.2011 19:08
Ja, bzw nicht ich direkt - ist zwar mein Läppi, hab ihn aber für eine Zeit einer Freundin geliehen. Als Dankeschön krieg ich ihn jetzt verseucht zurück :/
Aber sie hat damit auf jeden Fall midestens Onlinebanking gemacht...
siehts so schlimm aus?

markusg 28.11.2011 19:23
hi,
das muss nicht unbedingt die schuld deiner freundin sein, der trojaner der bankdaten stiehlt kann da schon n bissel länger drauf sein, 1,5 wochendieses gerät muss auf jeden fall, nach datensicherung, formatiert werden
vorher autorun aus:
Tipparchiv - Autorun/Autoplay gezielt für Laufwerkstypen oder -buchstaben abschalten - WinTotal.de
dann bilder, dokumente, vidios, musik, persönliches auf nen externen datnträger.
falls du nicht weist, wie man formatiert, erkläre ich es dir.
dann zeige ich dir wie man das system absichert.
dann noch was zum sicheren onlinebanking mit card reader.
danach musst du alle passwörter endern.
es kann auch nichts schaden dem bankberater mal bescheid zu geben (ihr beide) dass du ein trojaner problem hattest.
wenn du das gleich tun willst (banking sperren) notfallnummer:
116 116

cuyito 28.11.2011 19:33
Ohje... naja, dann werd ich mal.
Soll ich die eingebaute Dell-Wiederherstellungspartition nehmen? Wahrscheinlich besser, oder?
Wenn ich fertig bin, meld ich mich wieder.

Vielen vielen Dank für die Mühe! :)

markusg 28.11.2011 19:40
genau, und dann hiermit weiter

anmerkungen:
- ich empfehle als av emsisoft. es ist zwar kostenpflichtig, bietet aber aus meiner sicht den besten schutz, für schüler und studenten gibts das um die hälfte verbilligt.
man kanns 30 tage testen.
- als kostenloses av würde ich dann avast empfehlen, ist zwar nicht ganz so gut aber ok.
- als browser opera, falls der dir nicht zusagt, bescheid geben, dann muss ich die anleitung anpassen
die anleitung sollte komplett durchgearbeitet werden, bei fragen, stelle sie ich werde alles beantworten

http://www.trojaner-board.de/96344-a...-rechners.html
Starte bitte mit der Passage, Windows xp
außer, windows dienste, der link geht nicht.
also windows updates, ie8 automatische updates konfigurieren etc.
rufe dann im internet explorer die windows update seite auf, spiele treiber, optionale und wichtige updates ein
Als nächstes kommen wir zu dem Antimalware Programm.
Dieses ist ein wichtiger Bestandteil des Sicherheitskonzeptes, deswegen sollte man sich gut überlegen, welche Wahl man trifft.
Bei den kostenlosen Scannern halte ich Persönlich Avast! für die beste Wahl.
Als kostenpflichtiges würde ich Emsisoft empfehlen
Meine Antivirus-Empfehlung: Emsisoft Anti-Malware
Weitere Vertreter .
kaspersky:
Kaspersky Lab: Antivirus software
Symantec (Norton)
Symantec - AntiVirus, Anti-Spyware, Endpoint Security, Backup, Storage Solutions

Browserwahl:
Da wir häufig mit dem Browser arbeiten, ist diese Wahl natürlich ebenfalls wichtig, die wichtigen Vertreter befinden sich in dem Verlinktem Thema.
ich persönlich rate dir zum opera
Sandboxie
Die devinition einer Sandbox ist hier nachzulesen:
Sandbox
Kurz gesagt, man kann Programme fast 100 %ig isuliert vom System ausführen.

Der Vorteil liegt klar auf der Hand, wenn über den Browser Schadcode eingeschläust wird, kann dieser nicht nach außen dringen.
Download Link:
http://filepony.de/download-sandboxie/
anleitung:
http://www.trojaner-board.de/71542-a...sandboxie.html
ausführliche anleitung als pdf, auch abarbeiten:
http://filepony.de/download-sandboxie/

Wie du evtl. schon gesehen hast, kannst du einige Funktionen nicht nutzen.
Dies ist nur in der Vollversion nötig, zu deren Kauf ich dir rate.
Du kannst zb unter "Erzwungene Programmstarts" festlegen, dass alle Browser in der Sandbox starten.
Ansonsten musst du immer auf "Sandboxed webbrowser" klicken bzw Rechtsklick, in Sandboxie starten.
Eine lebenslange Lizenz kostet 30 €, und ist auf allen deinen PC's nutzbar.

Weiter mit:
Maßnahmen für ALLE Windows-Versionen
alles komplett durcharbeiten
Backup Programm:
in meiner Anleitung ist bereits ein Backup Programm verlinkt, als Alternative bietet sich auch das Windows eigene Backup Programm an:
Anleitung: Backup mit Windows 7-Bordmitteln - NETZWELT
Dies ist aber leider nur für Windows 7 Nutzer vernünftig nutzbar.
Alle Anderen sollten sich aber auf jeden fall auch ein Backup Programm instalieren, denn dies kann unter Umständen sehr wichtig sein, zum Beispiel, wenn die Festplatte einmal kaputt ist.

Zum Schluss, die allgemeinen sicherheitstipps beachten, wenn es dich betrifft, den Tipp zum Onlinebanking beachten und alle Passwörter ändern
surfe jetzt also nur noch im standard nutzer konto und dort in der sandbox.
wenn du die kostenlose version nutzt, dann mit klick auf sandboxed web browser, wenn du die bezahlversion hast, kannst du erzwungene programm starts festlegen, dann wird sandboxie immer gestartet wenn du nen browser aufrufst.
wenn du mit der maus über den browser fährst sollte der eingerahmt sein, dann bist du im sandboxed web browser

cuyito 29.11.2011 17:58
Hey, ich bin noch dabei die Datensicherung zu machen. Ich werde bestimmt Fragen haben (erste Frage: warum ist avast besser als avira? - zweite Frage: ist Firefox so schlimm? Sollte ich auf Opera umsteigen? Oder ist das nur Geschmackssache?), melde mich dann wenn es soweit ist.

Gruß
--cuy

markusg 29.11.2011 18:11
hi, wie gesagt würde ich emsisoft nutzen
da du onlinebanking machst.
aus folgenden gründen:
- gute signaturen erkennung, ähnlich wie avira.
da aber signaturen erkennung heut zu tage nicht mehr alles ist, es gibt laut statistik rund 80000 neue malware samples pro tag, ist eine verhaltensanalyse wichtig, und die ist bei emsi sehr gut.
blocken von websites ist ebenfalls gut.
zu avast:
1. bietet avira einen web schutz nur gegen eine toolbar an, finde ich nicht gut.
2. hast du bei avast noch einiges mehr an schutz moulen wie zb eine verhaltensanalyse, bei weitem nicht so gut wie bei emsisoft, besser aber als bei avira, und für unbekannte dateien eine autosandbox.
also kurz um, der funktionsumfang ist höher.
natürlich gilt immer, 100 %igen schutz gibts nicht, deswegen treffen wir weitere maßnamen.
opera und firefox:
natürlich ist es teilweise geschmackssache welchen browser man nutzt, opera bringt aber von hause aus mehr funkionen mit die man beim firefox erst nachrüsten muss.
außerdem ist er sicherer als der firefox, in den letzten jahren war der ff immer weit vorn was sicherheitslücken angeht.
meiner meinung nach ist er auch schneller als der ff.

cuyito 02.12.2011 17:18
Hallo,
bin soweit durch mit der Anleitung. Ich werde Opera ausprobieren, werd auch die ganzen Sicherheitsmaßnahmen auf meinem Desktop-PC anwenden.
Emsisoft kaufen überleg ich mir, werds erstmal testen.
Soweit habe ich alles richtig gemacht (hoffe ich zumindest), muss mich noch n bisschen einlesen wg Sandboxie...
Vielen Dank dir erstmal! Gruß

--cuy

markusg 02.12.2011 17:21
ok, wenn bei sandboxie fragen bestehen, oder bei einem der andern schritte, sags mir ruhig, ich gehe wirklich alles mit dir durch, ist kein problem
auch wenn du nen andern browser nutzen willst, müsste ich n paar kleinigkeiten anpassen.
hast du emsisoft instaliert? dann kann ich dir konfigurationshinweise geben


Alle Zeitangaben in WEZ +1. Es ist jetzt 18:48 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132