Hallo zusammen,

ich habe seit Freitag oben genannten Trojaner auf der Platte. Trotz mehrmaliger Antivir Löschaktionen kommt die Meldung in der angegebener Datei immer wieder. Ein weiterer User schien selbiges Problem zu besitzen, aber eine Lösung konnte qg fehlender OTL Dateien nicht gewährt werden.

Eine Hilfe wäre echt super!




Hier meine Auswertung

OTL logfile created on: 21.11.2011 18:24:10 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\*NAME\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,99 Gb Total Physical Memory | 1,84 Gb Available Physical Memory | 61,58% Memory free
5,99 Gb Paging File | 4,64 Gb Available in Paging File | 77,48% Paging File free
Paging file location(s): c:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = c:\Program Files
Drive C: | 151,60 Gb Total Space | 103,18 Gb Free Space | 68,06% Space Free | Partition Type: NTFS
Drive D: | 146,48 Gb Total Space | 4,86 Gb Free Space | 3,32% Space Free | Partition Type: NTFS

Computer Name: *NAME-PC | User Name: *NAME | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\*NAME\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Babylon\Babylon-Pro\Babylon.exe (Babylon Ltd.)
PRC - C:\Programme\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.)
PRC - c:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
PRC - c:\Programme\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation)
PRC - c:\Programme\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation)
PRC - c:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
PRC - c:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - c:\Programme\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
PRC - c:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - D:\Program Files\SRWare Iron\iron.exe (SRWare)
PRC - c:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Samsung\Samsung Update Plus\SUPNotifier.exe ()
PRC - c:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
PRC - C:\Programme\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
PRC - C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
PRC - C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe (Samsung Electronics Co., Ltd.)
PRC - C:\Programme\WIDCOMM\Bluetooth Software\BTStackServer.exe (Broadcom Corporation.)
PRC - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
PRC - C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
PRC - C:\Windows\System32\StkCSrv.exe (Syntek America Inc.)


========== Modules (No Company Name) ==========

MOD - C:\Users\*NAME\AppData\Roaming\5044\components\AcroFF044.dll ()
MOD - C:\Users\*NAME\AppData\Local\Chromium\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\1.2_0\BabylonChromePI.dll ()
MOD - C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
MOD - D:\Program Files\SRWare Iron\avcodec-52.dll ()
MOD - D:\Program Files\SRWare Iron\avformat-52.dll ()
MOD - D:\Program Files\SRWare Iron\avutil-50.dll ()
MOD - C:\Programme\Samsung\Samsung Update Plus\SUPNotifier.exe ()
MOD - D:\Program Files\WinRAR\RarExt.dll ()
MOD - c:\Programme\TeraCopy\TeraCopy.dll ()
MOD - C:\Programme\TeraCopy\TeraCopyExt.dll ()
MOD - C:\Programme\Samsung\Samsung Update Plus\HMXML.dll ()
MOD - C:\Programme\Samsung\Easy Display Manager\HookDllPS2.dll ()


========== Win32 Services (SafeList) ==========

SRV - (vpnagent) -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.)
SRV - (nvUpdatusService) -- c:\Programme\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (NVIDIA Corporation)
SRV - (AntiVirService) -- c:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (AntiVirSchedulerService) -- c:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (NisSrv) -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (Paragon System Backup Dienst) -- D:\Program Files\Paragon Software\Backup and Recovery 11 Kompakt\program\dbhservice.exe (Paragon Software Group)
SRV - (EvtEng) Intel(R) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation)
SRV - (MyWiFiDHCPDNS) -- C:\Programme\Intel\WiFi\bin\PanDhcpDns.exe ()
SRV - (RegSrvc) Intel(R) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation)
SRV - (btwdins) -- C:\Programme\WIDCOMM\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV - (StorSvc) -- C:\Windows\System32\StorSvc.dll (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (PeerDistSvc) -- C:\Windows\System32\PeerDistSvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- c:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (StkSSrv) -- C:\Windows\System32\StkCSrv.exe (Syntek America Inc.)


========== Driver Services (SafeList) ==========

DRV - (MpKslb24db9ce) -- c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{5CCDD252-740C-4646-8DCE-ADEA623A7A08}\MpKslb24db9ce.sys (Microsoft Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (vpnva) -- C:\Windows\System32\drivers\vpnva.sys (Cisco Systems, Inc.)
DRV - (UsbserFilt) -- C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (nmwcdnsu) -- C:\Windows\System32\drivers\nmwcdnsu.sys (Nokia)
DRV - (nmwcdnsuc) -- C:\Windows\System32\drivers\nmwcdnsuc.sys (Nokia)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (NisDrv) -- C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (MpNWMon) -- C:\Windows\System32\drivers\MpNWMon.sys (Microsoft Corporation)
DRV - (vmbus) -- C:\Windows\system32\drivers\vmbus.sys (Microsoft Corporation)
DRV - (storflt) -- C:\Windows\system32\drivers\vmstorfl.sys (Microsoft Corporation)
DRV - (storvsc) -- C:\Windows\system32\drivers\storvsc.sys (Microsoft Corporation)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (VMBusHID) -- C:\Windows\system32\drivers\VMBusHID.sys (Microsoft Corporation)
DRV - (s3cap) -- C:\Windows\system32\drivers\vms3cap.sys (Microsoft Corporation)
DRV - (Uim_IM) -- C:\Windows\System32\drivers\Uim_IM.sys (Paragon)
DRV - (hotcore3) -- C:\Windows\system32\DRIVERS\hotcore3.sys (Paragon Software Group)
DRV - (UimBus) -- C:\Windows\System32\drivers\UimBus.sys (Windows (R) 2000 DDK provider)
DRV - (DrvAgent32) -- C:\Windows\System32\drivers\DrvAgent32.sys (Phoenix Technologies)
DRV - (EverestDriver) -- D:\Program Files\Lavalys\EVEREST Ultimate Edition\kerneld.wnt ()
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (vwifimp) -- C:\Windows\System32\drivers\vwifimp.sys (Microsoft Corporation)
DRV - (StkCMini) -- C:\Windows\System32\drivers\StkCMini.sys (Syntek)
DRV - (yukonw7) -- C:\Windows\System32\drivers\yk62x86.sys (Marvell)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bigseekpro.com/solidyoutube/{9AFBEF54-BE35-483B-AFE4-9220113C3429}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.msn.com/?ocid=ie9hp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.bigseekpro.com/solidyoutube/{9AFBEF54-BE35-483B-AFE4-9220113C3429}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 5C 6D E9 E7 88 7B CC 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.bigseekpro.com/solidyoutube/{9AFBEF54-BE35-483B-AFE4-9220113C3429}"
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.4.76
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: firefox@tvunetworks.com:2
FF - prefs.js..extensions.enabledItems: 5
FF - prefs.js..extensions.enabledItems: 3
FF - prefs.js..extensions.enabledItems: 1
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:2.1.8
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.2.3
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.6
FF - prefs.js..extensions.enabledItems: firefox@red-cog.com:2.8
FF - prefs.js..extensions.enabledItems: adapter@babylontc.com:1.0.0.1
FF - prefs.js..extensions.enabledItems: ocr@babylon.com:1.0
FF - prefs.js..extensions.enabledItems: {184AA5E6-741D-464a-820E-94B3ABC2F3B4}:1.0
FF - prefs.js..keyword.URL: "hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: d:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Program Files\java\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@pages.tvunetworks.com/WebPlayer: C:\Windows\system32\TVUAx\npTVUAx.dll (TVU networks)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: d:\Program Files\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: d:\Program Files\Veetle\Player\npvlc.dll (Veetle Inc)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2011.09.06 15:11:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.11.20 17:21:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.11.20 17:21:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011.09.06 15:11:46 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\*NAME\AppData\Roaming\5044 [2011.11.20 18:17:16 | 000,000,000 | ---D | M]

[2010.06.13 11:50:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*NAME\AppData\Roaming\mozilla\Extensions
[2011.11.20 17:31:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*NAME\AppData\Roaming\mozilla\Firefox\Profiles\hshw0q5o.default\extensions
[2011.11.06 17:33:35 | 000,000,000 | ---D | M] (NoScript) -- C:\Users\*NAME\AppData\Roaming\mozilla\Firefox\Profiles\hshw0q5o.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2011.11.06 17:33:34 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\*NAME\AppData\Roaming\mozilla\Firefox\Profiles\hshw0q5o.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.11.06 17:33:34 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\*NAME\AppData\Roaming\mozilla\Firefox\Profiles\hshw0q5o.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011.08.31 11:32:01 | 000,000,000 | ---D | M] (Embedded Objects) -- C:\Users\*NAME\AppData\Roaming\mozilla\Firefox\Profiles\hshw0q5o.default\extensions\firefox@red-cog.com
[2010.08.15 13:28:40 | 000,000,000 | ---D | M] (TVU Web Player) -- C:\Users\*NAME\AppData\Roaming\mozilla\Firefox\Profiles\hshw0q5o.default\extensions\firefox@tvunetworks.com
[2010.11.28 18:15:56 | 000,000,000 | ---D | M] (vShare Plugin) -- C:\Users\*NAME\AppData\Roaming\mozilla\Firefox\Profiles\hshw0q5o.default\extensions\vshare@toolbar
[2011.08.28 17:45:03 | 000,000,000 | ---D | M] (YouTube to MP3) -- C:\Users\*NAME\AppData\Roaming\mozilla\Firefox\Profiles\hshw0q5o.default\extensions\youtube2mp3@mondayx.de
[2011.10.22 11:38:01 | 000,000,000 | ---D | M] (No name found) -- c:\Programme\Mozilla Firefox\extensions
[2010.10.03 11:18:20 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- c:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.07.06 18:00:46 | 000,000,000 | ---D | M] (Java Console) -- c:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.29 15:52:07 | 000,000,000 | ---D | M] (Java Console) -- c:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2011.05.12 19:05:31 | 000,000,000 | ---D | M] (Java Console) -- c:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.10.22 11:38:01 | 000,000,000 | ---D | M] ("Babylon Spelling and Proofreading") -- c:\Programme\Mozilla Firefox\extensions\adapter@babylontc.com
[2011.10.22 11:37:58 | 000,000,000 | ---D | M] (Babylon OCR) -- c:\Programme\Mozilla Firefox\extensions\ocr@babylon.com
[2010.10.03 11:18:20 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{AB2CE124-6272-4B12-94A9-7303C7397BD1}
[2010.07.06 18:00:46 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.29 15:52:07 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2011.05.12 19:05:31 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.10.22 11:38:01 | 000,000,000 | ---D | M] ("Babylon Spelling and Proofreading") -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\ADAPTER@BABYLONTC.COM
[2011.10.22 11:37:58 | 000,000,000 | ---D | M] (Babylon OCR) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\OCR@BABYLON.COM
[2011.09.06 15:11:45 | 000,000,000 | ---D | M] (Firefox Synchronisation Extension) -- C:\PROGRAM FILES\NOKIA\NOKIA OVI SUITE\CONNECTORS\BOOKMARKS CONNECTOR\FIREFOXEXTENSION
[2011.11.19 12:21:20 | 000,000,000 | ---D | M] (Java String Helper) -- C:\USERS\*NAME\APPDATA\ROAMING\5043
[2011.02.02 20:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- c:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.07.03 13:33:21 | 000,001,392 | ---- | M] () -- c:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.07.03 13:33:21 | 000,002,344 | ---- | M] () -- c:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.07.03 13:33:21 | 000,006,805 | ---- | M] () -- c:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.07.03 13:33:21 | 000,001,178 | ---- | M] () -- c:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.07.03 13:33:21 | 000,001,105 | ---- | M] () -- c:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml

========== Chrome ==========

CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{googleriginalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
CHR - Extension: Cooliris = C:\Users\*NAME\AppData\Local\Google\Chrome\User Data\Default\Extensions\noocneohefmdhonidldnlhaainpiomkp\1.12.0.36021\

O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (vShare Plugin) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - c:\Programme\vShare\vshare_toolbar.dll ()
O2 - BHO: (Babylon IE plugin) - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - c:\Programme\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\java\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (vShare Plugin) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - c:\Programme\vShare\vshare_toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (vShare Plugin) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - c:\Programme\vShare\vshare_toolbar.dll ()
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [avgnt] c:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Babylon Client] c:\Program Files\Babylon\Babylon-Pro\Babylon.exe (Babylon Ltd.)
O4 - HKLM..\Run: [IntelWireless] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel(R) Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe (Nokia)
O4 - HKCU..\Run: [] File not found
O4 - HKCU..\Run: [Userinit] C:\Users\*NAME\AppData\Roaming\appconf32.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: Translate this web page with Babylon - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O8 - Extra context menu item: Translate with Babylon - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - c:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O9 - Extra 'Tools' menuitem : Translate this web page with Babylon - {F72841F0-4EF1-4df5-BCE5-B3AC8ACF5478} - c:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll (Babylon Ltd.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: samsungsetup.com ([www] http in Vertrauenswürdige Sites)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C6CEB74B-0AC1-4D88-A48F-10AF9C078625}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D124C589-8C20-431F-AFA6-33F5DB166788}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - E:\PFiles\Common\System\OLEDB\MSDAIPP.DLL File not found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - E:\PFiles\Common\System\OLEDB\MSDAIPP.DLL File not found
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - E:\PFiles\Common\System\OLEDB\MSDAIPP.DLL File not found
O18 - Protocol\Handler\vsharechrome {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - c:\Programme\vShare\vshare_toolbar.dll ()
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{1a1c229d-ad23-11df-b5d0-00242cf5ca37}\Shell - "" = AutoRun
O33 - MountPoints2\{1a1c229d-ad23-11df-b5d0-00242cf5ca37}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.11.21 18:18:03 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\*NAME\Desktop\OTL.exe
[2011.11.21 17:54:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SRWare Iron2
[2011.11.20 18:17:16 | 000,000,000 | ---D | C] -- C:\Users\*NAME\AppData\Roaming\5044
[2011.11.19 12:21:20 | 000,000,000 | ---D | C] -- C:\Users\*NAME\AppData\Roaming\5043
[2011.11.19 12:21:13 | 000,220,112 | ---- | C] (Adobe Systems, Incorporated) -- C:\Users\*NAME\AppData\Roaming\AcroIEHelpe048.dll
[2011.11.13 14:42:37 | 000,000,000 | ---D | C] -- C:\Users\*NAME\AppData\Roaming\5039
[2011.11.09 23:02:13 | 002,341,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011.11.06 18:57:30 | 000,000,000 | ---D | C] -- C:\Users\*NAME\AppData\Roaming\5038
[2011.11.06 18:56:23 | 000,000,000 | ---D | C] -- C:\Users\*NAME\AppData\Roaming\xmldm
[2011.11.06 18:56:22 | 000,000,000 | ---D | C] -- C:\Users\*NAME\AppData\Roaming\kock
[2011.11.03 18:20:34 | 000,000,000 | ---D | C] -- C:\Users\*NAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
[34 C:\Users\*NAME\Documents\*.tmp files -> C:\Users\*NAME\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\*NAME\Desktop\*.tmp files -> C:\Users\*NAME\Desktop\*.tmp -> ]
[1 C:\Users\*NAME\AppData\Roaming\*.tmp files -> C:\Users\*NAME\AppData\Roaming\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.11.21 18:18:07 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\*NAME\Desktop\OTL.exe
[2011.11.21 17:43:09 | 000,016,896 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.11.21 17:43:08 | 000,016,896 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.11.21 17:40:49 | 000,656,266 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.11.21 17:40:49 | 000,618,108 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.11.21 17:40:49 | 000,131,006 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.11.21 17:40:49 | 000,107,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.11.21 17:35:09 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.11.20 20:22:11 | 000,000,036 | ---- | M] () -- C:\Users\*NAME\AppData\Roaming\blckdom.res
[2011.11.19 14:52:44 | 000,000,951 | ---- | M] () -- C:\Users\*NAME\Desktop\Trillian.lnk
[2011.11.19 12:21:13 | 000,220,112 | ---- | M] (Adobe Systems, Incorporated) -- C:\Users\*NAME\AppData\Roaming\AcroIEHelpe048.dll
[2011.11.18 15:56:45 | 000,001,715 | ---- | M] () -- C:\Users\*NAME\AppData\Roaming\SAS7_000.DAT
[2011.11.10 19:11:36 | 000,316,608 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.11.10 19:09:38 | 000,045,484 | ---- | M] () -- C:\Users\*NAME\Documents\cc_20111110_190836 gesichterteregistry.reg
[2011.11.04 21:37:51 | 000,509,952 | ---- | M] () -- C:\Users\*NAME\Documents\A-755 *NAME+*NAME+01221_doc.dra
[34 C:\Users\*NAME\Documents\*.tmp files -> C:\Users\*NAME\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\*NAME\Desktop\*.tmp files -> C:\Users\*NAME\Desktop\*.tmp -> ]
[1 C:\Users\*NAME\AppData\Roaming\*.tmp files -> C:\Users\*NAME\AppData\Roaming\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.11.10 19:09:05 | 000,045,484 | ---- | C] () -- C:\Users\*NAME\Documents\cc_20111110_190836 gesichterteregistry.reg
[2011.11.06 18:57:22 | 000,000,036 | ---- | C] () -- C:\Users\*NAME\AppData\Roaming\blckdom.res
[2011.11.04 21:37:51 | 000,509,952 | ---- | C] () -- C:\Users\*NAME\Documents\A-755 *NAME+*NAME+01221_doc.dra
[2011.10.24 11:23:45 | 000,002,537 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Excel Viewer.lnk
[2011.10.22 11:41:27 | 000,032,256 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2011.10.22 11:38:27 | 000,107,520 | RHS- | C] () -- C:\Windows\System32\TAKDSDecoder.dll
[2011.10.03 17:30:08 | 000,260,248 | ---- | C] () -- C:\Windows\System32\QMO.dll
[2011.10.03 17:30:08 | 000,092,312 | ---- | C] () -- C:\Windows\System32\QMOCameraDll.dll
[2011.07.24 11:53:37 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.07.11 02:25:14 | 000,024,064 | ---- | C] () -- C:\Windows\System32\ssp7ml3.dll
[2010.07.21 15:20:38 | 000,001,024 | ---- | C] () -- C:\Windows\System32\PDF2TXT.DAT
[2010.06.20 18:14:31 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.06.19 14:47:22 | 000,001,715 | ---- | C] () -- C:\Users\*NAME\AppData\Roaming\SAS7_000.DAT
[2010.06.14 20:22:36 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.06.14 20:22:35 | 000,001,471 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2010.06.14 18:44:42 | 000,197,648 | ---- | C] () -- C:\Windows\System32\drivers\StkCSF.sys
[2010.06.14 18:44:42 | 000,088,592 | ---- | C] () -- C:\Windows\StkUnist.exe
[2009.07.14 09:47:43 | 000,656,266 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009.07.14 09:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009.07.14 09:47:43 | 000,131,006 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009.07.14 09:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 05:33:53 | 000,316,608 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009.07.14 03:05:48 | 000,618,108 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009.07.14 03:05:48 | 000,107,388 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2008.12.09 16:23:13 | 000,054,048 | RHS- | C] () -- C:\Users\*NAME\AppData\Roaming\appconf32.exe

========== Alternate Data Streams ==========

@Alternate Data Stream - 209 bytes -> C:\ProgramData\TEMP:A24211BA
@Alternate Data Stream - 120 bytes -> C:\ProgramData\TEMP:661DFA1C

< End of report >



EXTRAS.TXT:


OTL Extras logfile created on: 21.11.2011 18:24:10 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\NAME\Desktop
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,99 Gb Total Physical Memory | 1,84 Gb Available Physical Memory | 61,58% Memory free
5,99 Gb Paging File | 4,64 Gb Available in Paging File | 77,48% Paging File free
Paging file location(s): c:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = c:\Program Files
Drive C: | 151,60 Gb Total Space | 103,18 Gb Free Space | 68,06% Space Free | Partition Type: NTFS
Drive D: | 146,48 Gb Total Space | 4,86 Gb Free Space | 3,32% Space Free | Partition Type: NTFS

Computer Name: NAME-PC | User Name: NAME | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Reg Error: Value error.] -- Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromiumHTML] -- D:\Program Files\SRWare Iron\iron.exe (SRWare)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "d:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "d:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00170407-78E1-11D2-B60F-006097C998E7}" = Microsoft Word 2000 SR-1
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{07D77970-B205-460C-84E4-263F30455597}" = Nokia Ovi Suite
"{12451AF7-EFF8-4B5B-8255-282D7CC7CAEE}" = OviMPlatform
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager
"{1E1DFF42-2EE8-4852-A7AB-C5174321D68F}" = Paragon Backup & Recovery™ 11 Kompakt
"{1E5F3CC6-D390-4393-A2AA-6CEC04F1705A}" = Image Resizer Powertoy Clone for Windows
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 24
"{2CC53A53-44F4-4667-8584-2FFC9ACB2242}" = Ovi Desktop Sync Engine
"{2D99A593-C841-43A7-B7C9-D6F3AE70B756}" = Nokia Connectivity Cable Driver
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{44257960-C5CC-45BA-8E83-524E4A0F3FD5}" = Cisco AnyConnect VPN Client
"{4A5A427F-BA39-4BF0-9A47-9999FBE60C9F}" = Visual C++ Runtime for Dragon NaturallySpeaking
"{4F88F5D8-767A-4EB4-9AFA-A7CBCC69D767}" = Windows Live SOXE
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack
"{52CDDA92-56B6-4BA5-BD8D-E13B186008CB}" = D3DX10
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{5EE59813-493A-4C10-A2BF-3647670CD7D6}" = Windows Live UX Platform Language Pack
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{7E432D8D-D78A-44A8-9FE8-B8942F7FD01F}" = Windows Live UX Platform
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{91973772-A002-446D-8A67-B410553AD8F9}" = Windows Live SOXE Definitions
"{95120000-003F-0409-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{95140000-00AF-0407-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{960C278D-E4F9-41AD-9073-1B663A7E8CAA}" = USB2.0 UVC WebCam
"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = WIDCOMM Bluetooth Software
"{A8F7FCEF-3CA6-4CE9-8FEA-8BB18F8686F0}" = Nokia Ovi Suite Software Updater
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B158F76F-76AB-4115-A4F0-4C6EF6956093}_is1" = VirtualDubMOD 1.5.10.3 US
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 280.26
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 280.26
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 280.19
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.10.0514
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.4.28
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.2.23.3
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B660E0D0-A8CB-45A7-96FB-93E8C915A0B2}" = Easy Network Manager
"{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = SUPER © v2011.build.49 (July 1st, 2011) Version v2011.build.49
"{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}" = NVIDIA PhysX
"{C373F7C4-05D2-4047-96D1-6AF30661C6AA}" = PC Connectivity Solution
"{C59CF2CE-B302-4833-AA35-E0E07D8EBC52}_is1" = SRWare Iron 15.0.900.0
"{C78EAC6F-7A73-452E-8134-DBB2165C5A68}" = QuickTime
"{CCAFF072-4DDB-4846-963D-15F02A8E9472}" = Intel(R) PROSet/Wireless WiFi-Software
"{D1434266-0486-4469-B338-A60082CC04E1}" = Atheros Client Installation Program
"{D3F2FAA5-FEC4-42AA-9ABA-1F763919A2B5}" = Samsung Update Plus
"{E7712E53-7A7F-46EB-AA13-70D5987D30F2}" = Dragon NaturallySpeaking 10
"504244733D18C8F63FF584AEB290E3904E791693" = Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)
"A6A8668C0A13640CA28FE2A7D9654BE4AE478B13" = Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"AVI Splitter_is1" = AVI Splitter
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"B7541EC5F72AA713F557569278EB6273725F5607" = Windows Driver Package - Broadcom Bluetooth (06/15/2009 6.2.0.9000)
"Babylon" = Babylon
"BF20603967CFDCB2BBF91950E8A56DFBC5C833FE" = Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800)
"CCleaner" = CCleaner
"DivX Setup.divx.com" = DivX-Setup
"DriverAgent.exe" = DriverAgent by eSupport.com
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.50
"Foxit Reader_is1" = Foxit Reader 5.0
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"GonVisor_is1" = GonVisor 1.74
"JDownloader" = JDownloader
"Marvell Miniport Driver" = Marvell Miniport Driver
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"mIRC" = mIRC
"MKVtoolnix" = MKVtoolnix 5.0.1
"Mozilla Firefox (3.6.24)" = Mozilla Firefox (3.6.24)
"Nokia Ovi Suite" = Nokia Ovi Suite
"NVIDIA StereoUSB Driver" = NVIDIA 3D Vision Controller Driver
"Picasa 3" = Picasa 3
"ProInst" = Intel PROSet Wireless
"SopCast" = SopCast 3.2.9
"SystemRequirementsLab" = System Requirements Lab
"TeraCopy_is1" = TeraCopy 2.2
"TreeSize Free_is1" = TreeSize Free V2.5
"Trillian" = Trillian
"USB2.0 UVC 1.3M WebCam" = USB2.0 UVC 1.3M WebCam
"Veetle TV" = Veetle TV 0.9.18
"VLC media player" = VLC media player 1.1.0
"vShare" = vShare Plugin
"WinRAR archiver" = WinRAR
"WT-Rate" = WT-Rate 3.76

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 20.11.2011 07:24:45 | Computer Name = NAME-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error - 20.11.2011 07:24:45 | Computer Name = NAME-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error - 20.11.2011 13:17:44 | Computer Name = NAME-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error - 20.11.2011 14:00:01 | Computer Name = NAME-PC | Source = Windows Backup | ID = 4103
Description =

Error - 21.11.2011 12:35:21 | Computer Name = NAME-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error - 21.11.2011 12:35:21 | Computer Name = NAME-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error - 21.11.2011 13:22:10 | Computer Name = NAME-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.31.0 kann nicht mehr unter Windows ausgeführt
werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 518 Startzeit:
01cca871f2cba297 Endzeit: 12 Anwendungspfad: D:\OTL.exe Berichts-ID: 53aa9c80-1465-11e1-8e27-00242cf5ca37


Error - 21.11.2011 13:23:37 | Computer Name = NAME-PC | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.31.0 kann nicht mehr unter Windows ausgeführt
werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 102c Startzeit:
01cca87227263235 Endzeit: 4 Anwendungspfad: D:\OTL.exe Berichts-ID: 889b53d1-1465-11e1-8e27-00242cf5ca37


Error - 21.11.2011 13:28:11 | Computer Name = NAME-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error - 21.11.2011 13:28:13 | Computer Name = NAME-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

[ Cisco AnyConnect VPN Client Events ]
Error - 21.11.2011 12:35:19 | Computer Name = NAME-PC | Source = vpnagent | ID = 67108866
Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp
Line:
2423 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED

Error - 21.11.2011 12:35:19 | Computer Name = NAME-PC | Source = vpnagent | ID = 67108866
Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line:
2190 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED

Error - 21.11.2011 12:35:19 | Computer Name = NAME-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::testNetwork File: .\NetEnvironment.cpp Line:
644 Invoked Function: CHostConfigMgr:eterminePublicInterface Return Code: -33161196
(0xFE060014) Description: ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE

Error - 21.11.2011 12:35:19 | Computer Name = NAME-PC | Source = vpnagent | ID = 67108866
Description = Function: CNetEnvironment::TestNetEnv File: .\NetEnvironment.cpp Line:
190 Invoked Function: CNetEnvironment::testNetwork Return Code: -33161196 (0xFE060014)
Description:
ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE

Error - 21.11.2011 13:04:36 | Computer Name = NAME-PC | Source = vpnagent | ID = 67108866
Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp
Line:
2423 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED

Error - 21.11.2011 13:04:36 | Computer Name = NAME-PC | Source = vpnagent | ID = 67108866
Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line:
2190 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED

Error - 21.11.2011 13:04:36 | Computer Name = NAME-PC | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::applyHostConfigForNoVpn File: .\MainThread.cpp
Line:
7639 Invoked Function: CHostConfigMgr:eterminePublicInterface Return Code: -33161196
(0xFE060014) Description: ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE

Error - 21.11.2011 13:04:36 | Computer Name = NAME-PC | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::OnTimerExpired File: .\MainThread.cpp Line: 4287
Invoked
Function: CMainThread::applyHostConfigForNoVpn Return Code: -33161196 (0xFE060014)
Description:
ROUTEMGR_ERROR_PUBLIC_ADDRESS_UNAVAILABLE

Error - 21.11.2011 13:04:37 | Computer Name = NAME-PC | Source = vpnagent | ID = 67108866
Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp
Line:
2423 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED

Error - 21.11.2011 13:04:37 | Computer Name = NAME-PC | Source = vpnagent | ID = 67108866
Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line:
2190 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED

[ System Events ]
Error - 16.11.2011 03:56:19 | Computer Name = NAME-PC | Source = Microsoft Antimalware | ID = 3002
Description = Fehler in %%860-Echtzeitschutzfunktion. Funktion: %%835 Fehlercode:
0x80004005 Fehlerbeschreibung: Unbekannter Fehler Ursache: %%842

Error - 16.11.2011 15:48:05 | Computer Name = NAME-PC | Source = Microsoft Antimalware | ID = 3002
Description = Fehler in %%860-Echtzeitschutzfunktion. Funktion: %%835 Fehlercode:
0x80004005 Fehlerbeschreibung: Unbekannter Fehler Ursache: %%842

Error - 18.11.2011 05:03:17 | Computer Name = NAME-PC | Source = Microsoft Antimalware | ID = 3002
Description = Fehler in %%860-Echtzeitschutzfunktion. Funktion: %%835 Fehlercode:
0x80004005 Fehlerbeschreibung: Unbekannter Fehler Ursache: %%842

Error - 18.11.2011 09:22:15 | Computer Name = NAME-PC | Source = Microsoft Antimalware | ID = 3002
Description = Fehler in %%860-Echtzeitschutzfunktion. Funktion: %%835 Fehlercode:
0x80004005 Fehlerbeschreibung: Unbekannter Fehler Ursache: %%842

Error - 18.11.2011 10:30:43 | Computer Name = NAME-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error - 19.11.2011 06:49:16 | Computer Name = NAME-PC | Source = Microsoft Antimalware | ID = 3002
Description = Fehler in %%860-Echtzeitschutzfunktion. Funktion: %%835 Fehlercode:
0x80004005 Fehlerbeschreibung: Unbekannter Fehler Ursache: %%842

Error - 19.11.2011 06:57:29 | Computer Name = NAME-PC | Source = Microsoft Antimalware | ID = 3002
Description = Fehler in %%860-Echtzeitschutzfunktion. Funktion: %%835 Fehlercode:
0x80004005 Fehlerbeschreibung: Unbekannter Fehler Ursache: %%842

Error - 19.11.2011 08:51:19 | Computer Name = NAME-PC | Source = Microsoft Antimalware | ID = 3002
Description = Fehler in %%860-Echtzeitschutzfunktion. Funktion: %%835 Fehlercode:
0x80004005 Fehlerbeschreibung: Unbekannter Fehler Ursache: %%842

Error - 19.11.2011 14:37:07 | Computer Name = NAME-PC | Source = Microsoft Antimalware | ID = 3002
Description = Fehler in %%860-Echtzeitschutzfunktion. Funktion: %%835 Fehlercode:
0x80004005 Fehlerbeschreibung: Unbekannter Fehler Ursache: %%842

Error - 20.11.2011 07:25:37 | Computer Name = NAME-PC | Source = Microsoft Antimalware | ID = 3002
Description = Fehler in %%860-Echtzeitschutzfunktion. Funktion: %%835 Fehlercode:
0x80004005 Fehlerbeschreibung: Unbekannter Fehler Ursache: %%842

[ TuneUp Events ]
Error - 06.07.2011 17:16:29 | Computer Name = NAME-PC | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 06.07.2011 17:16:29 | Computer Name = NAME-PC | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 06.07.2011 17:16:29 | Computer Name = NAME-PC | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 12.07.2011 14:21:05 | Computer Name = NAME-PC | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 12.07.2011 14:21:05 | Computer Name = NAME-PC | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 12.07.2011 14:21:05 | Computer Name = NAME-PC | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 13.07.2011 18:07:49 | Computer Name = NAME-PC | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 13.07.2011 18:07:49 | Computer Name = NAME-PC | Source = TuneUp.UtilitiesSvc | ID = 300
Description =

Error - 13.07.2011 18:07:49 | Computer Name = NAME-PC | Source = TuneUp.UtilitiesSvc | ID = 300
Description =


< End of report >

hiho
falls du deinen nutzernamen geendert hast in den logs, musst du es in meinem script anpassen sonst läufts nicht
achtung!
dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
O4 - HKCU..\Run: [Userinit] C:\Users\*NAME\AppData\Roaming\appconf32.exe ()
[2011.11.20 18:17:16 | 000,000,000 | ---D | C] -- C:\Users\*NAME\AppData\Roaming\5044
[2011.11.19 12:21:20 | 000,000,000 | ---D | C] -- C:\Users\*NAME\AppData\Roaming\5043
[2011.11.19 12:21:13 | 000,220,112 | ---- | C] (Adobe Systems, Incorporated) -- C:\Users\*NAME\AppData\Roaming\AcroIEHelpe048.dll
[2011.11.13 14:42:37 | 000,000,000 | ---D | C] -- C:\Users\*NAME\AppData\Roaming\5039
[2011.11.06 18:57:30 | 000,000,000 | ---D | C] -- C:\Users\*NAME\AppData\Roaming\5038
[2011.11.06 18:56:23 | 000,000,000 | ---D | C] -- C:\Users\*NAME\AppData\Roaming\xmldm
[2011.11.06 18:56:22 | 000,000,000 | ---D | C] -- C:\Users\*NAME\AppData\Roaming\kock
[34 C:\Users\*NAME\Documents\*.tmp files -> C:\Users\*NAME\Documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

:Files
C:\Users\*NAME\AppData\Roaming\appconf32.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.

öffne computer, öffne C: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
folge dem link, und lade das archiv im upload channel hoch
http://www.trojaner-board.de/54791-a...ner-board.html

So, erledigt.

In der Hektik, war ich mir

a) nicht sicher alle Programme geschlossen zu haben
b) beim Umnennen meines Namens (bzw des PC-Namens) könnte ich was falsch gemacht haben. Würde dann ggfs einen weiteren Versuc starten wollen.
c) rar wird jetzt hochgeladen



All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Userinit deleted successfully.
File move failed. C:\Users\Marcel\AppData\Roaming\appconf32.exe scheduled to be moved on reboot.
C:\Users\Marcel\AppData\Roaming\5044\components folder moved successfully.
C:\Users\Marcel\AppData\Roaming\5044 folder moved successfully.
C:\Users\Marcel\AppData\Roaming\5043\components folder moved successfully.
C:\Users\Marcel\AppData\Roaming\5043 folder moved successfully.
C:\Users\Marcel\AppData\Roaming\AcroIEHelpe048.dll moved successfully.
C:\Users\Marcel\AppData\Roaming\5039\components folder moved successfully.
C:\Users\Marcel\AppData\Roaming\5039 folder moved successfully.
C:\Users\Marcel\AppData\Roaming\5038\components folder moved successfully.
C:\Users\Marcel\AppData\Roaming\5038 folder moved successfully.
C:\Users\Marcel\AppData\Roaming\xmldm folder moved successfully.
C:\Users\Marcel\AppData\Roaming\kock folder moved successfully.
C:\Users\Marcel\Documents\~WRL0065.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL0076.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL0406.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL0435.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL0558.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL0591.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL0719.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL0796.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL1113.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL1228.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL1255.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL1364.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL1391.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL1417.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL1482.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL1483.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL1492.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL1582.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL1806.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL1809.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL1999.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL2174.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL2334.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL2383.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL2499.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL2787.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL3476.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL3566.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL3612.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL3698.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL3827.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL3935.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL3992.tmp deleted successfully.
C:\Users\Marcel\Documents\~WRL4006.tmp deleted successfully.
C:\Windows\msdownld.tmp folder deleted successfully.
========== FILES ==========
File move failed. C:\Users\Marcel\AppData\Roaming\appconf32.exe scheduled to be moved on reboot.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: Marcel
->Flash cache emptied: 39913 bytes

User: Public

User: UpdatusUser

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Marcel
->Temp folder emptied: 2762818 bytes
->Temporary Internet Files folder emptied: 9439696 bytes
->Java cache emptied: 2621767 bytes
->FireFox cache emptied: 53144343 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2400928 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 67,00 mb


OTL by OldTimer - Version 3.2.31.0 log created on 11212011_191904

Files\Folders moved on Reboot...
C:\Users\Marcel\AppData\Roaming\appconf32.exe moved successfully.

Registry entries deleted on Reboot...

passt so, weiter mit dem upload bitte

ist "oben"

wird dieses system für onlinebanking einkäufe oder sonst was wichtiges, wie zb berufliches, genutzt?

Studium, wichtig wären nur paar skripte, ansonsten einkäufe über kreditkarte mit nichtüberziehbaren Rahmen.

Bin von halsab gelähmt und Texte werden größtenteils diktiert, zudem ist zeit für ein komplettes neu-aufsetzen nur im notfall möglich.

hi, du hast einen trojaner der es auf sensible daten abgesehen hatt, name ist trojan.banker.
also auch kreditkarten info.
ich persönlich würd neu aufsetzen, da man nie 100 %ig sicher sagen kann, dass man ein system bereinigen kann, dies ist aber in deinem falle wichtig da ja schon mit sensiblen daten gearbeitet wird.
du bekommst für alles hilfe, auch erkläre ich dir, wie du in zukunft das system richtig absicherst.
auch mit backup etc.

Von 100%iger Sicherheit gehe ich sonst auch nicht aus. Deshalb prepaid mastercard. An einem allumfassenden Schutz glaub bisher nicht.

Momentan für ich einen vollen Scan der Platten durch, Das Ergebnis war positiv (außer den Treffern bei der movedfiles.rar).

Falls ich nä. WE Zeit hab, welche Sicherheiten schlägt ihr vor?


Btw. danke für den bisherigen Erfolg

hi, was für nen scan, wie gesagt es bringt eig nichts einen scan durchzuführen die zeit ist besser genutzt wenn du neu aufsetzt, erst danach ist es auch wirklich sinnvoll sicherheitsmaßnamen zu bearbeiten

sry, muss parallel eine Vorlesung für morgen vorbereiten. Die Zeit seh ich echt erst am Samstag bis dahin brauch ich den Rechner, solang er Texte umsetzen kann.

Dann besorg ich ne neue externe und Sicher das System anschließend.

sehe ich das richtig, dass eine draufinstallation von w7 nicht ausreicht ? Muss zweite partition auch formatiert werden? Soll MBR auch gelöscht werden? Welche Daten kann ich problemlos sichern?

danke im vorraus

wenn die möglichkeit besteht, alle partitionen löschen und neu erstellen, mbr muss dann nicht gelöscht werden, sichern kannst du alle wichtigen dokumente, drüberinstalieren reicht nicht, bis zum wochenende ists aber ok zu warten.