Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Bundespolizei Virus jashla.exe

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 10.08.2011, 17:42   #1
ManiacKill
 
Bundespolizei Virus jashla.exe - Standard

Bundespolizei Virus jashla.exe



Einen schönen guten Abend,

seit gestern ist mein PC mit diesem Virus verseucht, hab mal OTL Programm durchlaufen gelassen und poste mal die Log datein! PC kann man nicht mehr benutzen kommt immer das BKA Bild ! Vieleicht kann jemand helfen würde mich freuen !

OTL Logfile:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 8/9/2011 9:11:06 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
992.00 Mb Total Physical Memory | 809.00 Mb Available Physical Memory | 82.00% Memory free
883.00 Mb Paging File | 828.00 Mb Available in Paging File | 94.00% Paging File free
Paging file location(s): D:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 9.32 Gb Total Space | 0.34 Gb Free Space | 3.69% Space Free | Partition Type: NTFS
Drive D: | 363.29 Gb Total Space | 86.33 Gb Free Space | 23.76% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Disabled] --  -- (NMIndexingService)
SRV - File not found [On_Demand] --  -- (AppMgmt)
SRV - [2011/07/18 02:11:44 | 000,208,264 | ---- | M] ( ) [Auto] -- C:\Programme\GbPlugin\gbpsv.exe -- (GbpSv)
SRV - [2010/01/15 08:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand] -- C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2007/01/17 06:20:10 | 000,061,440 | ---- | M] (Hewlett-Packard Company) [Auto] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2003/11/14 14:17:38 | 000,966,656 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Sony\giga pocket\GPVSvr.exe -- (VAIOMediaPlatform-VideoServer-AppServer)
SRV - [2003/11/14 10:24:06 | 000,118,784 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Sony\giga pocket\halsv.exe -- (Sony TV Tuner Controller)
SRV - [2003/11/14 10:23:20 | 000,090,112 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Sony\giga pocket\RM_SV.exe -- (Sony TV Tuner Manager)
SRV - [2003/11/14 10:23:20 | 000,077,824 | ---- | M] (Sony Corporation) [Auto] -- C:\Programme\Sony\giga pocket\shwserv.exe -- (Giga Pocket Hardware Detector)
SRV - [2003/10/21 05:48:08 | 000,679,936 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Sony Shared\vaio media platform\UPnPFramework.exe -- (VAIOMediaPlatform-VideoServer-UPnP) VAIO Media Video Server (UPnP)
SRV - [2003/10/21 05:48:08 | 000,679,936 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Sony Shared\vaio media platform\UPnPFramework.exe -- (VAIOMediaPlatform-PhotoServer-UPnP) VAIO Media Photo Server (UPnP)
SRV - [2003/10/21 05:48:08 | 000,679,936 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Sony Shared\vaio media platform\UPnPFramework.exe -- (VAIOMediaPlatform-MusicServer-UPnP) VAIO Media Music Server (UPnP)
SRV - [2003/09/19 16:29:14 | 000,540,749 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Sony\vaio media music server\SSSvr.exe -- (VAIOMediaPlatform-MusicServer-AppServer)
SRV - [2003/07/28 12:31:14 | 000,065,536 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Sony Shared\AVLib\Sptisrv.exe -- (SPTISRV)
SRV - [2003/06/24 05:08:06 | 000,860,160 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Sony\photo server\appsrv\PhotoAppSrv.exe -- (VAIOMediaPlatform-PhotoServer-AppServer)
SRV - [2003/06/23 08:42:30 | 000,057,344 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\sony shared\vaio media platform\SV_Httpd.exe -- (VAIOMediaPlatform-VideoServer-HTTP) VAIO Media Video Server (HTTP)
SRV - [2003/06/23 08:42:30 | 000,057,344 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\sony shared\vaio media platform\SV_Httpd.exe -- (VAIOMediaPlatform-PhotoServer-HTTP) VAIO Media Photo Server (HTTP)
SRV - [2003/06/23 08:42:30 | 000,057,344 | ---- | M] (Sony Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Sony Shared\vaio media platform\sv_httpd.exe -- (VAIOMediaPlatform-MusicServer-HTTP) VAIO Media Music Server (HTTP)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | Boot] --  -- (nielprt)
DRV - File not found [Kernel | On_Demand] --  -- (NielGfx)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (i2omgmt)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2011/07/18 02:13:36 | 000,043,600 | ---- | M] (GAS Tecnologia) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\gbpkm.sys -- (GbpKm)
DRV - [2010/04/28 01:44:02 | 000,054,760 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\fssfltr_tdi.sys -- (fssfltr)
DRV - [2007/06/17 06:43:50 | 000,186,592 | ---- | M] (Jungo) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\windrvr6.sys -- (WinDriver6)
DRV - [2005/05/27 03:46:22 | 000,913,280 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LV302AV.SYS -- (PID_08A0) QuickCam IM(PID_08A0)
DRV - [2005/05/27 03:38:00 | 000,007,136 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\lv302af.sys -- (pepifilter)
DRV - [2005/05/27 03:31:28 | 000,022,016 | ---- | M] (Logitech Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2003/11/24 05:54:10 | 000,011,264 | R--- | M] (Silicon Integrated Systems Corporation) [Kernel | System] -- C:\WINDOWS\system32\drivers\srvkp.sys -- (SiSkp)
DRV - [2003/10/30 06:20:54 | 000,766,848 | ---- | M] (Sony Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\smrt.sys -- (smrt)
DRV - [2003/10/13 18:57:34 | 000,426,752 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\sisgrp.sys -- (SiS315)
DRV - [2003/09/02 10:07:50 | 000,058,112 | ---- | M] (SMSC) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SMSCMS.SYS -- (SMSCMS)
DRV - [2003/07/22 13:24:16 | 000,015,126 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LCcfltr.sys -- (LCcfltr)
DRV - [2003/07/22 13:23:44 | 000,073,368 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LMouFlt2.Sys -- (LMouFlt2)
DRV - [2003/07/22 13:22:42 | 000,026,072 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LHidFlt2.Sys -- (LHidFlt2)
DRV - [2003/07/22 13:22:02 | 000,037,782 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\LHidUsb.sys -- (LHidUsb)
DRV - [2003/06/15 07:31:00 | 000,175,744 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSFHWSIS.sys -- (HSFHWSIS)
DRV - [2003/06/15 07:28:28 | 000,631,552 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2003/06/15 07:27:18 | 001,063,296 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_DP.sys -- (HSF_DP)
DRV - [2003/01/13 05:43:56 | 000,030,720 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\SISAGPX.SYS -- (sisagp)
DRV - [2002/06/13 06:37:16 | 000,045,568 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\R8139n51.sys -- (rtl8139)
DRV - [2000/12/05 10:18:02 | 000,003,952 | R--- | M] (Sony Corporation) [Kernel | System] -- C:\WINDOWS\system32\drivers\DMICall.sys -- (DMICall)
DRV - [2000/11/09 14:15:08 | 000,048,896 | ---- | M] (Sony Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SonyNC.sys -- (SNC)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.club-vaio.sony-europe.com/
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\LocalService_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.club-vaio.sony-europe.com/
IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 30 33 53 41 9C 90 CA 01  [binary data]
IE - HKU\_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\NetworkService_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.club-vaio.sony-europe.com/
IE - HKU\NetworkService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Programme\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
 
 
O1 HOSTS File: ([2011/06/11 12:41:16 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Auxiliar de Conexão do Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (no name) - {B3CC3ACF-0C2C-410F-AE7A-9C1FF9887FE9} -  File not found
O2 - BHO: (GbIehObj Class) - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Programme\GbPlugin\gbieh.dll (Banco do Brasil)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Easy-WebPrint\Toolband.dll ()
O3 - HKU\_ON_C\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\_ON_C\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\_ON_C\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\_ON_C\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\_ON_C\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ezShieldProtector for Px] C:\WINDOWS\system32\ezSP_Px.exe (Easy Systems Japan Ltd.)
O4 - HKLM..\Run: [HKSERV.EXE] C:\Programme\Sony\HotKey Utility\HKServ.exe (Sony Corporation)
O4 - HKLM..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [OpwareSE2] D:\OpwareSE2.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [SiS Tray]  File not found
O4 - HKU\_ON_C..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]  File not found
O4 - HKLM..\RunOnce: [ GbPluginBb] C:\Programme\GbPlugin\gbieh.dll (Banco do Brasil)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk = C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Remocon-Treiber.lnk = C:\Programme\Sony\usbsircs\USBsircs.exe (Sony Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Timer Recording Manager.lnk = C:\Programme\Sony\giga pocket\ReserveModule.exe (Sony Corporation)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\VAIO Action Setup (Server).lnk = C:\Programme\Sony\VAIO Action Setup\VAServ.exe (Sony Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O12 - Plugin for: .spop - C:\Programme\Internet Explorer\PLUGINS\NPDocBox.dll (Intertrust Technologies, Inc.)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (C:\DOKUME~1\\LOKALE~1\Temp\R66v.exe) - C:\Dokumente und Einstellungen\\Lokale Einstellungen\Temp\R66v.exe (Shots Sheer Mites Caruso)
O20 - Winlogon\Notify\ GbPluginBb: DllName - C:\Programme\GbPlugin\gbieh.dll - C:\Programme\GbPlugin\gbieh.dll (Banco do Brasil)
O28 - HKLM ShellExecuteHooks: {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\Programme\GbPlugin\gbieh.dll (Banco do Brasil)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/11/06 06:43:45 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/08/05 02:38:44 | 000,014,640 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsgXP_2k3.dll
[2011/08/05 02:37:55 | 001,112,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\WdfCoInstaller01007.dll
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011/08/09 13:40:30 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/08/09 13:40:19 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/08/09 04:58:05 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/08/07 10:48:14 | 000,000,550 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Photoshop 7.0 (2).lnk
[2011/08/05 04:52:57 | 000,000,510 | ---- | M] () -- C:\Dokumente und Einstellungen\\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Easy-PhotoPrint (2).lnk
[2011/08/05 02:39:15 | 000,000,000 | ---- | M] () -- C:\extensions.sqlite
[2011/08/05 02:38:56 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_nielprt_01007.Wdf
[2011/08/05 02:38:54 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2011/08/05 02:38:52 | 000,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/08/02 08:56:20 | 000,000,550 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Photoshop 7.0.lnk
[2011/07/28 04:06:49 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/07/18 02:13:36 | 000,043,600 | ---- | M] (GAS Tecnologia) -- C:\WINDOWS\System32\drivers\gbpkm.sys
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011/08/07 10:48:14 | 000,000,550 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Adobe Photoshop 7.0 (2).lnk
[2011/08/05 04:52:57 | 000,000,510 | ---- | C] () -- C:\Dokumente und Einstellungen\\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Easy-PhotoPrint (2).lnk
[2011/08/05 02:39:15 | 000,000,000 | ---- | C] () -- C:\extensions.sqlite
[2011/08/05 02:38:56 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\Msft_Kernel_nielprt_01007.Wdf
[2011/08/05 02:38:54 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
[2011/04/17 05:38:29 | 000,000,384 | ---- | C] () -- C:\WINDOWS\MAXLINK.INI
[2011/04/16 06:10:24 | 000,000,215 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI
[2010/07/30 02:49:52 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\InstMed.exe
[2010/07/30 02:49:48 | 000,009,255 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2010/05/08 19:05:14 | 000,234,193 | ---- | C] () -- C:\Dokumente und Einstellungen\\Lokale Einstellungen\Anwendungsdaten\yefjn_nav.dat
[2010/05/08 19:05:14 | 000,003,254 | ---- | C] () -- C:\Dokumente und Einstellungen\\Lokale Einstellungen\Anwendungsdaten\yefjn.dat
[2010/05/08 19:05:14 | 000,001,391 | ---- | C] () -- C:\Dokumente und Einstellungen\\Lokale Einstellungen\Anwendungsdaten\yefjn_navps.dat
[2010/05/08 19:05:13 | 000,438,272 | ---- | C] () -- C:\Dokumente und Einstellungen\\Lokale Einstellungen\Anwendungsdaten\yefjn.exe
[2010/01/18 09:14:58 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2009/09/25 04:45:58 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OpPrintServer.INI
[2008/09/14 07:48:19 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\CNMVS64.DLL
[2008/03/25 12:03:03 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2008/03/14 15:09:22 | 000,000,091 | ---- | C] () -- C:\Dokumente und Einstellungen\\default.pls
[2008/03/13 13:34:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\lgfwup.ini
[2008/03/13 13:31:17 | 000,040,960 | ---- | C] () -- C:\Programme\Uninstall_CDS.exe
[2008/03/13 13:24:10 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008/03/13 12:59:49 | 000,079,360 | ---- | C] () -- C:\Dokumente und Einstellungen\\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/03/01 12:22:33 | 000,001,295 | ---- | C] () -- C:\WINDOWS\System32\Px.ini
[2008/03/01 12:18:22 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\Cpuinf32.dll
[2008/03/01 12:16:44 | 000,262,416 | ---- | C] () -- C:\WINDOWS\System32\ASFV2.DLL
[2008/03/01 12:15:56 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\TDI-SonyOMG.dll
[2004/08/02 09:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2003/11/25 04:43:11 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\sis740.bin
[2003/11/25 04:43:11 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\sis650.bin
[2003/11/06 09:44:27 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2003/11/06 06:54:52 | 000,034,403 | ---- | C] () -- C:\WINDOWS\System32\1_ssetup.ini
[2003/11/06 06:54:52 | 000,016,558 | ---- | C] () -- C:\WINDOWS\System32\sunistlog.ini
[2003/11/06 06:53:54 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\setuplib.dll
[2003/11/06 06:53:54 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\waitwnd.exe
[2003/11/06 06:48:39 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\pxhpinst.exe
[2003/11/06 06:47:00 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2003/11/06 06:46:07 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2003/11/06 06:44:56 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2003/11/06 06:42:42 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2003/11/06 06:40:29 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2003/11/06 06:39:57 | 000,147,608 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2003/11/06 06:29:50 | 000,002,862 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2003/11/06 06:29:42 | 000,449,132 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2003/11/06 06:29:42 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2003/11/06 06:29:42 | 000,080,456 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2003/11/06 06:29:42 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2003/11/06 06:29:17 | 000,432,806 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2003/11/06 06:29:17 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2003/11/06 06:29:17 | 000,067,762 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2003/11/06 06:29:17 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2003/11/06 06:29:16 | 000,004,530 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2003/11/06 06:29:15 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2003/11/06 06:29:13 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003/11/06 06:29:06 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2003/11/06 06:29:06 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2003/11/06 06:28:58 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2003/11/06 06:28:52 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2003/11/05 04:31:12 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\cbldrm.dll
[2002/08/06 05:55:37 | 000,024,576 | ---- | C] () -- C:\WINDOWS\ml-WA3Shutdown.exe
[2002/04/02 11:08:36 | 000,372,749 | ---- | C] () -- C:\WINDOWS\ml-uninstall-v10.exe
[2002/04/02 11:08:34 | 000,311,590 | ---- | C] () -- C:\WINDOWS\ml-cleanup.exe
[2002/04/02 11:08:32 | 000,036,868 | ---- | C] () -- C:\WINDOWS\ml-winamp-shutdown.exe
 
========== LOP Check ==========
 
[2008/03/07 11:08:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\Canon
[2011/04/17 05:26:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\InterTrust
[2008/03/14 07:04:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\InterVideo
[2011/04/17 05:38:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\ScanSoft
[2010/12/09 05:00:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\Start
[2011/07/04 05:54:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\\Anwendungsdaten\TP
[2011/07/28 04:06:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GbPlugin
[2008/03/14 07:57:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LightScribe
[2011/06/27 03:59:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PMB Files
[2011/04/17 05:38:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SSScanAppDataDir
[2011/04/17 05:38:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SSScanWizard
[2010/10/08 17:22:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 8 bytes -> C:\WINDOWS\System32\drivers:IncompleteBoot.cnt
@Alternate Data Stream - 2 bytes -> C:\WINDOWS\system32:73CE1F90_Bb.gbp
@Alternate Data Stream - 125 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
@Alternate Data Stream - 102 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:430C6D84
< End of report >
         
--- --- ---

EXTRAS Logfile:OTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 8/9/2011 9:55:19 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
992.00 Mb Total Physical Memory | 777.00 Mb Available Physical Memory | 78.00% Memory free
883.00 Mb Paging File | 806.00 Mb Available in Paging File | 91.00% Paging File free
Paging file location(s): D:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 9.32 Gb Total Space | 0.34 Gb Free Space | 3.69% Space Free | Partition Type: NTFS
Drive D: | 363.29 Gb Total Space | 86.33 Gb Free Space | 23.76% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"56100:TCP" = 56100:TCP:*:Enabled:Pando Media Booster
"56100:UDP" = 56100:UDP:*:Enabled:Pando Media Booster
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"56100:TCP" = 56100:TCP:*:Enabled:Pando Media Booster
"56100:UDP" = 56100:UDP:*:Enabled:Pando Media Booster
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Sony\giga pocket\gps.exe" = C:\Programme\Sony\giga pocket\gps.exe:*:Disabled:Giga Pocket Server -- (Sony Corporation)
"D:\E-Mule\eMule0.47a-sivka.v17b1-alpha-bin\emule.exe" = D:\E-Mule\eMule0.47a-sivka.v17b1-alpha-bin\emule.exe:*:Enabled:eMule
"D:\FlashGet\flashget.exe" = D:\FlashGet\flashget.exe:*:Enabled:Flashget
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"D:\E-Mule\eMule0.47a-sivka.v17b1-alpha-bin\Incoming\emule.exe" = D:\E-Mule\eMule0.47a-sivka.v17b1-alpha-bin\Incoming\emule.exe:*:Enabled:eMule
"C:\Programme\Java\jre6\bin\java.exe" = C:\Programme\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"D:\E-Mule\emule.exe" = D:\E-Mule\emule.exe:*:Enabled:eMule -- (hxxp://www.emule-project.net)
"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0E3F1A40-3104-4C76-8A2D-2CC2ED414BD1}" = ISP Selector
"{0FFEA8EE-7BC7-4C9D-8CC6-5B8C891BA3F2}" = Windows Live Essentials
"{18A5DFF2-8A95-49F3-873F-743CB5549F3D}" = Canon ScanGear Starter
"{1D057E97-A116-4BF9-B307-83C3FBD86515}" = VAIO Clock Screen Saver
"{1EB317D8-8945-4FD6-B37F-DF470317C6AB}" = VAIO Media 2.5
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = Multimedia Launcher
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2366D960-F00F-11D3-99D3-00C04FCCB775}" = VAIO System Information
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java(TM) 6 Update 20
"{27337663-2619-11D4-99DC-0000F49094C7}" = Memory Stick Formatter
"{2D9D1CE4-8C3D-469A-9894-0857B6C9F426}" = VAIO Media Setup 2.5
"{2DF215E0-BD3C-4C98-8616-AFEF09747285}" = Windows Live Sync
"{3147661C-2807-49EC-B971-3B0F23D95018}" = VAIO DeepSea Wallpaper
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3B24B725-D81F-442D-8CE5-2AF05A4A4CC9}" = Music Visualizer Library 1.4.00
"{3C67D8C0-F0EC-11D3-99D3-00C04FCCB775}" = VAIO Action Setup
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4C75086F-7753-41B9-8B4C-F38DE6CC8C20}" = VAIO Remote Commander Utility 6.2
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{4D1D6640-CD43-4AD9-A52F-E48265DB28E0}" = VAIO BrightColor Wallpaper
"{51A9E3DD-37B8-47BB-8E67-5B76B3EFBC48}" = Assistente de Conexão do Windows Live
"{590035D9-BFA0-406A-A7F0-479C72C0DDB2}" = Windows Live Call
"{5F2CE2DD-5119-4860-9E46-6A0129A34FF1}" = Giga Pocket Demo Movie
"{5FA1C51C-6E35-42C1-B2EC-DC9FA1E20694}" = OpenMG Secure Module 3.3.01
"{63C6BABD-0BF7-488B-9AB5-B989E23CC581}" = VAIO Media Video Server 2.5
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{685BCC47-B8EC-45EC-BBCE-77DF2451502C}" = DVgate Plus
"{6990A2BF-D1D2-11D3-81BC-00609789C908}" = Sony Video Shared Library
"{7128C69B-8F7E-4336-8698-3FD3CDD955EC}" = VAIO Media Redistribution 2.5
"{7148F0A8-6813-11D6-A77B-00B0D0142010}" = Java 2 Runtime Environment, SE v1.4.2_01
"{71D6CE84-B7DC-4166-8E0D-56C1C37BFB5A}" = SonicStage 1.6.00
"{74AD1846-2010-4FB1-8E24-B6F2B87150C2}" = Windows Live Mail
"{761C9026-14F0-4352-8658-934558272404}" = VAIO Edit Components
"{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}" = OmniPage SE 2.0
"{7C2F71B2-6C73-11D6-B659-00C04F790F76}" = Click to DVD 1.3
"{85309D89-7BE9-4094-BB17-24999C6118FC}" = ArcSoft PhotoStudio 5.5
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87A9C015-C2BA-44EE-9C20-6E1A764B8E23}" = Windows Live Galeria de Fotos
"{88DA0A52-3372-4803-971A-ADFB961707E8}" = PictureGear Studio 2.0
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD 5 for VAIO
"{93B80FB1-7A23-11D3-B250-00105A1F4184}" = 
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9555B4ED-09A3-4722-8E8C-57A49401D059}" = Windows Live Writer
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9ADC3E4F-34DA-48CD-8727-BB26D90257BD}" = Windows Live Messenger
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.5 - Deutsch
"{B0D71B3D-D679-4BF7-9F9C-5C98F34345DF}" = Windows Live Proteção para a Família
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{B97CF5C3-0487-11D8-A36E-0050BAE317E1}" = DVD Solution
"{BB311F54-39D6-4A03-8E18-053D1B2833D7}" = HotKey Utility
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}" = Canon CanoScan Toolbox 4.9
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe  1.4.142.1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare Software
"{D4A90BFA-C75E-420A-BB00-D54C82A5A245}" = Giga Pocket 5.5
"{D958FAC4-BAE0-4B1D-A42E-DE9BFDE7DDEE}" = Canon PhotoRecord
"{DF0DD6E9-F673-4466-8353-70B50A506FD9}" = VAIO Media Platform 2.5
"{DF733005-0F40-11D6-9254-0000F460E7A9}" = VAIO Media Music Server 2.5
"{EA7FC832-8133-46B4-B2CF-5A955326D309}" = Wireless Desktop
"{EDDDC607-91D9-4758-9F57-265FDCD8A772}" = Microsoft Works 7.0 
"{EF3D45BB-2260-4008-88EA-492E7744A9DF}" = Sony Utilities DLL
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F6587A1E-A87D-4CF9-9BA6-CE2CEB58950E}" = VAIO Media Photo Server 2.5
"{F898AB3C-792E-4351-B3E8-4958BAA8E101}" = Giga Pocket Hardware Library 5.5
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"CANONBJ_Deinstall_CNMCP64.DLL" = Canon PIXMA iP4000
"CNXT_MODEM_PCI_VEN_1039&DEV_7013&SUBSYS_816F104D" = SoftK56 Data Fax
"Easy-PhotoPrint" = Canon Utilities Easy-PhotoPrint
"Easy-PrintToolBox" = Canon Utilities Easy-PrintToolBox
"Easy-WebPrint" = Easy-WebPrint
"ie8" = Windows Internet Explorer 8
"InCD!UninstallKey" = InCD
"InstallShield_{0E3F1A40-3104-4C76-8A2D-2CC2ED414BD1}" = ISP Selector (Deutsch)
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MoodLogic" = MoodLogic
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"QcDrv" = Logitech® Camera-Treiber
"SiS Compatible VGA V2.21a" = SiS Compatible VGA V2.21a
"SiS Compatible VGA V2.21a.01" = SiS Compatible VGA V2.21a.01
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"xp-AntiSpy" = xp-AntiSpy 3.97-8
"yefjn" = Favorit
 
< End of report >
         
--- --- ---

Alt 11.08.2011, 22:51   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Bundespolizei Virus jashla.exe - Standard

Bundespolizei Virus jashla.exe



Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
ATTFilter
:OTL
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Auxiliar de Conexão do Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (no name) - {B3CC3ACF-0C2C-410F-AE7A-9C1FF9887FE9} -  File not found
O2 - BHO: (GbIehObj Class) - {C41A1C0E-EA6C-11D4-B1B8-444553540000} - C:\Programme\GbPlugin\gbieh.dll (Banco do Brasil)
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Easy-WebPrint\Toolband.dll ()
O3 - HKU\_ON_C\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\_ON_C\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\_ON_C\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\_ON_C\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\_ON_C\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O4 - HKLM..\Run: [SiS Tray]  File not found
O4 - HKU\_ON_C..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]  File not found
O4 - HKLM..\RunOnce: [ GbPluginBb] C:\Programme\GbPlugin\gbieh.dll (Banco do Brasil)
O20 - HKLM Winlogon: Shell - (C:\DOKUME~1\\LOKALE~1\Temp\R66v.exe) - C:\Dokumente und Einstellungen\\Lokale Einstellungen\Temp\R66v.exe (Shots Sheer Mites Caruso)
O20 - Winlogon\Notify\ GbPluginBb: DllName - C:\Programme\GbPlugin\gbieh.dll - C:\Programme\GbPlugin\gbieh.dll (Banco do Brasil)
O28 - HKLM ShellExecuteHooks: {E37CB5F0-51F5-4395-A808-5FA49E399F83} - C:\Programme\GbPlugin\gbieh.dll (Banco do Brasil)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2003/11/06 06:43:45 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
@Alternate Data Stream - 8 bytes -> C:\WINDOWS\System32\drivers:IncompleteBoot.cnt
@Alternate Data Stream - 2 bytes -> C:\WINDOWS\system32:73CE1F90_Bb.gbp
@Alternate Data Stream - 125 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
@Alternate Data Stream - 102 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:430C6D84
:Commands
[purity]
[resethosts]
         
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen!
2.) Ordner movedfiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html
4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten
__________________

__________________

Antwort

Themen zu Bundespolizei Virus jashla.exe
0x00000001, adobe flash player, alternate, bho, einstellungen, error, explorer, flash player, format, hotkey, langs, launch, log, logfile, photoshop, programm, realtek, reatogo, registry, rundll, scan, security, security scan, shell32.dll, software, stick, tcp, temp, udp, version=1.0, virus, windows, windows internet, windows xp



Ähnliche Themen: Bundespolizei Virus jashla.exe


  1. Bundestrojaner - jashla.exe?
    Plagegeister aller Art und deren Bekämpfung - 25.11.2011 (6)
  2. Jashla.exe Desktop weg
    Plagegeister aller Art und deren Bekämpfung - 22.09.2011 (1)
  3. BKA-Trojaner / Jashla.exe
    Log-Analyse und Auswertung - 19.09.2011 (22)
  4. jashla.exe/Bundespolizei-Scareware plötzlich nicht mehr auffindbar
    Plagegeister aller Art und deren Bekämpfung - 13.09.2011 (22)
  5. jashla.exe / BKA-Virus -> meine Logs
    Mülltonne - 07.09.2011 (1)
  6. jashla.exe wieder da
    Log-Analyse und Auswertung - 02.09.2011 (9)
  7. Virusbefall jashla.exe "Bundespolizei"
    Log-Analyse und Auswertung - 29.08.2011 (17)
  8. Jashla.exe/UKASH/Bundespolizei-Trojaner
    Log-Analyse und Auswertung - 28.08.2011 (19)
  9. Wie kann man dem jashla.exe (Bundestrojaner) vorbeugen oder Wie gelangt jashla auf den Rechner
    Plagegeister aller Art und deren Bekämpfung - 22.08.2011 (2)
  10. BKA-Trojaner jashla.exe auf dem PC
    Plagegeister aller Art und deren Bekämpfung - 18.08.2011 (6)
  11. Nach Entfernung des Bundespolizei-Trojaners (jashla.exe) startet der Windows-Explorer nicht mehr
    Log-Analyse und Auswertung - 17.08.2011 (4)
  12. jashla.exe - Bundespolizei - UKash 100 Euro
    Plagegeister aller Art und deren Bekämpfung - 15.08.2011 (1)
  13. BKA Virus jashla.exe - Benoetige OTL fix
    Log-Analyse und Auswertung - 12.08.2011 (10)
  14. BKA Trojaner und jashla.exe....
    Log-Analyse und Auswertung - 11.08.2011 (8)
  15. Jashla.exe...
    Plagegeister aller Art und deren Bekämpfung - 10.08.2011 (1)
  16. Bundespolizei-Trojaner, Jashla.exe
    Log-Analyse und Auswertung - 08.08.2011 (1)
  17. BKA Trojaner jashla.exe Win XP
    Plagegeister aller Art und deren Bekämpfung - 08.08.2011 (1)

Zum Thema Bundespolizei Virus jashla.exe - Einen schönen guten Abend, seit gestern ist mein PC mit diesem Virus verseucht, hab mal OTL Programm durchlaufen gelassen und poste mal die Log datein! PC kann man nicht mehr - Bundespolizei Virus jashla.exe...
Archiv
Du betrachtest: Bundespolizei Virus jashla.exe auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.