Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: AKM Trojaner blockiert PC

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 17.03.2012, 13:36   #1
Pred8oR
 
AKM Trojaner blockiert PC - Standard

AKM Trojaner blockiert PC



Hallo,
habe leider auch den AKM Trojaner auf meinem PC. Abgesicherter Modus geht nicht *AKM Fenster*, habe daher mit dem OTLPE Tool einen Scan durchgefuehrt.
Anbei das OTl Log.

Danke fuer Eure Hilfe.

LG

Habe gelesen das man alles als Code Tag posten soll, daher noch einmal als Code.
Bin fuer jede hilfe dankbar!

lg

Code:
ATTFilter
OTL logfile created on: 3/17/2012 4:29:05 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Windows 7 Home Premium  (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 88.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 95.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 582.76 Gb Total Space | 345.12 Gb Free Space | 59.22% Space Free | Partition Type: NTFS
Drive H: | 13.41 Gb Total Space | 1.89 Gb Free Space | 14.09% Space Free | Partition Type: NTFS
Drive I: | 29.85 Gb Total Space | 4.72 Gb Free Space | 15.82% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand] --  -- (WPFFontCache_v0400)
SRV - [2012/02/28 12:38:52 | 001,373,576 | ---- | M] (LogMeIn Inc.) [Auto] -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012/01/19 07:47:20 | 003,027,840 | ---- | M] (TeamViewer GmbH) [Auto] -- C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe -- (TeamViewer7)
SRV - [2011/04/27 09:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV - [2011/04/27 09:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2011/03/27 06:18:19 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2010/01/15 08:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009/09/10 12:14:18 | 000,238,952 | ---- | M] (Teruten) [Auto] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService)
SRV - [2009/09/06 07:38:06 | 000,071,096 | ---- | M] () [Auto] -- C:\Program Files\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/02/10 12:01:49 | 000,116,104 | ---- | M] () [Auto] -- C:\Program Files\Canon\IJPLM\ijplmsvc.exe -- (IJPLMSVC)
SRV - [2009/01/04 06:00:00 | 000,129,584 | ---- | M] (EasyBits Sofware AS) [Auto] -- C:\Windows\System32\ezsvc7.dll -- (ezSharedSvc)
SRV - [2008/04/07 04:17:30 | 000,430,592 | ---- | M] (Nokia.) [On_Demand] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | System] --  -- (MpKslf8807a0f)
DRV - File not found [Kernel | System] --  -- (MpKslf486ea3b)
DRV - File not found [Kernel | System] --  -- (MpKsl959d88ee)
DRV - File not found [Kernel | System] --  -- (MpKsl83ff0b3d)
DRV - File not found [Kernel | System] --  -- (MpKsl80e8f387)
DRV - File not found [Kernel | System] --  -- (MpKsl76f17b8e)
DRV - File not found [Kernel | System] --  -- (MpKsl6d5b2c86)
DRV - File not found [Kernel | System] --  -- (MpKsl466b9be9)
DRV - File not found [Kernel | On_Demand] --  -- (EagleNT)
DRV - [2011/07/07 11:13:46 | 000,015,896 | ---- | M] (HandSet Incorporated) [Kernel | On_Demand] -- C:\Windows\System32\drivers\massfilter_hs.sys -- (massfilter_hs)
DRV - [2011/04/27 09:25:24 | 000,065,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2011/04/18 07:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
DRV - [2011/04/12 13:44:34 | 000,099,840 | ---- | M] (Protect Software GmbH) [Kernel | Auto] -- C:\Windows\System32\drivers\ACEDRV06.sys -- (ACEDRV06)
DRV - [2011/03/28 10:34:42 | 000,113,432 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ghsmdm.sys -- (ghsmdm)
DRV - [2011/01/12 05:42:16 | 000,013,304 | ---- | M] (TeamViewer GmbH) [Kernel | On_Demand] -- C:\Windows\System32\drivers\TVMonitor.sys -- (MonitorFunction)
DRV - [2010/08/08 17:33:00 | 010,337,768 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010/06/21 22:51:14 | 000,049,904 | R--- | M] (Avanquest Software) [Kernel | On_Demand] -- C:\Windows\System32\drivers\BVRPMPR5.SYS -- (BVRPMPR5)
DRV - [2009/08/31 04:23:28 | 000,036,608 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2009/07/30 11:12:54 | 000,287,392 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvmf6232.sys -- (NVNET)
DRV - [2009/07/13 19:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/06/08 13:54:06 | 001,071,136 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
DRV - [2009/04/24 12:54:06 | 000,061,984 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2009/03/18 12:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2008/11/12 13:02:46 | 000,146,464 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2008/11/12 13:02:46 | 000,133,152 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\system32\DRIVERS\nvrd32.sys -- (nvrd32)
DRV - [2008/05/22 05:39:34 | 000,015,360 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled] -- C:\Windows\system32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2007/10/25 12:26:10 | 000,005,632 | ---- | M] () [File_System | On_Demand] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2007/09/17 10:53:26 | 000,021,632 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_at&c=93&bd=Pavilion&pf=cndt
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=gppc&s={searchTerms}&f=4
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {90980889-669e-4bb9-9e4b-69563bf04375} - C:\Program Files\Games_Bar_2\prxtbGam2.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {9ebe5796-5b84-4bfb-a1fb-914e68d02032} - C:\Program Files\Softonic-Austria\prxtbSof1.dll (Conduit Ltd.)
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\Susi_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_at&c=93&bd=Pavilion&pf=cndt
IE - HKU\Susi_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://kurier.at/
IE - HKU\Susi_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\Susi_ON_C\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKU\Susi_ON_C\..\URLSearchHook: {90980889-669e-4bb9-9e4b-69563bf04375} - C:\Program Files\Games_Bar_2\prxtbGam2.dll (Conduit Ltd.)
IE - HKU\Susi_ON_C\..\URLSearchHook: {9ebe5796-5b84-4bfb-a1fb-914e68d02032} - C:\Program Files\Softonic-Austria\prxtbSof1.dll (Conduit Ltd.)
IE - HKU\Susi_ON_C\..\URLSearchHook: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\4.6\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
IE - HKU\Susi_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Susi_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
IE - HKU\Tim_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_at&c=93&bd=Pavilion&pf=cndt
IE - HKU\Tim_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
 
 
[2011/05/20 15:14:29 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/03/26 17:05:08 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/02/02 16:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/03/31 13:56:47 | 000,002,047 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
 
O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (CescrtHlpr Object) - {64182481-4F71-486b-A045-B233BD0DA8FC} - C:\Program Files\facemoods.com\facemoods\1.4.17.4\bh\facemoods.dll (facemoods.com BHO)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O2 - BHO: (Oryte Games 2 Toolbar) - {90980889-669e-4bb9-9e4b-69563bf04375} - C:\Program Files\Games_Bar_2\prxtbGam2.dll (Conduit Ltd.)
O2 - BHO: (Softonic-Austria Toolbar) - {9ebe5796-5b84-4bfb-a1fb-914e68d02032} - C:\Program Files\Softonic-Austria\prxtbSof1.dll (Conduit Ltd.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (YouTube Downloader Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\4.6\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Oryte Games 2 Toolbar) - {90980889-669e-4bb9-9e4b-69563bf04375} - C:\Program Files\Games_Bar_2\prxtbGam2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Softonic-Austria Toolbar) - {9ebe5796-5b84-4bfb-a1fb-914e68d02032} - C:\Program Files\Softonic-Austria\prxtbSof1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files\facemoods.com\facemoods\1.4.17.4\facemoodsTlbr.dll (facemoods.com)
O3 - HKLM\..\Toolbar: (YouTube Downloader Toolbar) - {F3FEE66E-E034-436a-86E4-9690573BEE8A} - C:\Program Files\YouTube Downloader Toolbar\IE\4.6\youtubedownloaderToolbarIE.dll (Spigot, Inc.)
O3 - HKU\Susi_ON_C\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKU\Susi_ON_C\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKU\Susi_ON_C\..\Toolbar\WebBrowser: (Oryte Games 2 Toolbar) - {90980889-669E-4BB9-9E4B-69563BF04375} - C:\Program Files\Games_Bar_2\prxtbGam2.dll (Conduit Ltd.)
O3 - HKU\Susi_ON_C\..\Toolbar\WebBrowser: (Softonic-Austria Toolbar) - {9EBE5796-5B84-4BFB-A1FB-914E68D02032} - C:\Program Files\Softonic-Austria\prxtbSof1.dll (Conduit Ltd.)
O3 - HKU\Tim_ON_C\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKU\Tim_ON_C\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} - C:\Program Files\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKU\Tim_ON_C\..\Toolbar\WebBrowser: (Oryte Games 2 Toolbar) - {90980889-669E-4BB9-9E4B-69563BF04375} - C:\Program Files\Games_Bar_2\prxtbGam2.dll (Conduit Ltd.)
O3 - HKU\Tim_ON_C\..\Toolbar\WebBrowser: (Softonic-Austria Toolbar) - {9EBE5796-5B84-4BFB-A1FB-914E68D02032} - C:\Program Files\Softonic-Austria\prxtbSof1.dll (Conduit Ltd.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [CLMLServer for HP TouchSmart] C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [DVDAgent] C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [facemoods] C:\Program Files\facemoods.com\facemoods\1.4.17.4\facemoodssrv.exe (facemoods.com)
O4 - HKLM..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HP Remote Software] C:\Program Files\Hewlett-Packard\HP Remote\HP REMOTE V1.0.5.exe ()
O4 - HKLM..\Run: [hpsysdrv] C:\Program Files\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard)
O4 - HKLM..\Run: [K3aRyluP6SiCkoR] C:\Users\Susi\AppData\Roaming\flint4ytw.exe (SearchHelp, Inc)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [MSC] C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SmartMenu] C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe (Hewlett-Packard)
O4 - HKLM..\Run: [TSMAgent] C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDIRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKU\Susi_ON_C..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKU\Susi_ON_C..\Run: [EA Core]  File not found
O4 - HKU\Susi_ON_C..\Run: [EADM] C:\Program Files\Electronic Arts\EADM\EADMUI\EADMUI.exe (Electronic Arts)
O4 - HKU\Susi_ON_C..\Run: [K3aRyluP6SiCkoR] C:\Users\Susi\AppData\Roaming\flint4ytw.exe (SearchHelp, Inc)
O4 - HKLM..\RunOnce: [AvgUninstallURL] C:\Windows\System32\cmd.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: Error locating startup folders.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideFastUserSwitching = 0
O7 - HKU\Susi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Susi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Susi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 0
O7 - HKU\Susi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableLockWorkstation = 0
O7 - HKU\Susi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Susi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\Susi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O7 - HKU\Susi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\Tim_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Tim_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\Tim_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab (GMNRev Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (C:\Users\Susi\AppData\Roaming\flint4ytw.exe) - C:\Users\Susi\AppData\Roaming\flint4ytw.exe (SearchHelp, Inc)
O20 - HKLM Winlogon: UserInit - (C:\Users\Susi\AppData\Roaming\flint4ytw.exe) - C:\Users\Susi\AppData\Roaming\flint4ytw.exe (SearchHelp, Inc)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\Susi_ON_C Winlogon: Shell - (C:\Users\Susi\AppData\Roaming\flint4ytw.exe) - C:\Users\Susi\AppData\Roaming\flint4ytw.exe (SearchHelp, Inc)
O20 - HKU\Susi_ON_C Winlogon: UserInit - (C:\Users\Susi\AppData\Roaming\flint4ytw.exe) - C:\Users\Susi\AppData\Roaming\flint4ytw.exe (SearchHelp, Inc)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/03/12 10:03:36 | 000,308,224 | ---- | C] (SearchHelp, Inc) -- C:\Users\Susi\AppData\Roaming\flint4ytw.exe
[2012/02/29 09:16:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2012/02/29 09:16:55 | 000,000,000 | ---D | C] -- C:\Program Files\LogMeIn Hamachi
[2012/02/26 12:54:13 | 000,000,000 | ---D | C] -- C:\Users\Susi\AppData\Roaming\ts3overlay
[2012/02/26 12:52:53 | 000,000,000 | ---D | C] -- C:\Users\Susi\AppData\Roaming\TS3Client
[2012/02/26 12:51:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2012/02/26 12:51:25 | 000,000,000 | ---D | C] -- C:\Program Files\TeamSpeak 3 Client
[2012/02/26 12:50:02 | 029,653,280 | ---- | C] (TeamSpeak Systems GmbH) -- C:\Users\Susi\Desktop\TeamSpeak3.exe
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/03/17 10:20:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/03/17 10:07:49 | 000,659,538 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012/03/17 10:07:49 | 000,620,814 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/03/17 10:07:49 | 000,131,810 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012/03/17 10:07:49 | 000,108,034 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/03/17 10:05:51 | 2414,731,264 | -HS- | M] () -- C:\hiberfil.sys
[2012/03/12 15:54:44 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012/03/12 15:22:01 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012/03/12 13:10:37 | 000,011,104 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/03/12 13:10:37 | 000,011,104 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/03/12 10:03:36 | 000,308,224 | ---- | M] (SearchHelp, Inc) -- C:\Users\Susi\AppData\Roaming\flint4ytw.exe
[2012/02/29 15:21:24 | 000,042,392 | ---- | M] () -- C:\Windows\System32\xfcodec.dll
[2012/02/29 09:16:58 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
[2012/02/26 12:52:37 | 000,001,126 | ---- | M] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2012/02/26 12:51:29 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
[2012/02/26 12:50:20 | 029,653,280 | ---- | M] (TeamSpeak Systems GmbH) -- C:\Users\Susi\Desktop\TeamSpeak3.exe
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/02/29 15:21:24 | 000,042,392 | ---- | C] () -- C:\Windows\System32\xfcodec.dll
[2012/02/26 12:51:29 | 000,001,126 | ---- | C] () -- C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
[2012/01/13 12:12:21 | 000,584,584 | ---- | C] () -- C:\Windows\adb.exe
[2012/01/07 03:20:05 | 000,723,518 | ---- | C] () -- C:\Users\Susi\AppData\Local\tmp005.6
[2012/01/07 03:20:01 | 000,723,518 | ---- | C] () -- C:\Users\Susi\AppData\Local\tmp005.5
[2012/01/07 03:19:54 | 000,723,568 | ---- | C] () -- C:\Users\Susi\AppData\Local\tmp005.4
[2012/01/07 03:19:49 | 000,723,595 | ---- | C] () -- C:\Users\Susi\AppData\Local\tmp005.3
[2012/01/07 03:19:45 | 000,723,606 | ---- | C] () -- C:\Users\Susi\AppData\Local\tmp005.2
[2012/01/07 03:19:41 | 000,723,577 | ---- | C] () -- C:\Users\Susi\AppData\Local\tmp005.1
[2012/01/07 03:19:41 | 000,723,511 | ---- | C] () -- C:\Users\Susi\AppData\Local\tmp005.JPG
[2012/01/07 03:19:23 | 003,401,921 | ---- | C] () -- C:\Users\Susi\AppData\Local\tmp005.0
[2012/01/07 03:19:09 | 000,013,918 | ---- | C] () -- C:\Users\Susi\AppData\Local\tmp005_navi.JPG
[2011/05/14 09:03:17 | 000,006,136 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2011/04/28 08:39:14 | 000,148,612 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2011/03/26 18:07:46 | 000,007,606 | ---- | C] () -- C:\Users\Susi\AppData\Local\Resmon.ResmonCfg
[2011/03/26 17:25:01 | 000,021,532 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat
[2009/12/27 09:10:46 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll
[2009/12/27 09:10:46 | 000,036,608 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys
[2009/11/22 13:23:42 | 000,000,019 | ---- | C] () -- C:\Windows\popcinfo.dat
[2009/11/20 06:02:07 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/11/18 06:21:08 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2009/09/01 10:30:57 | 000,009,300 | ---- | C] () -- C:\Windows\System32\ezdigsgn.dat
[2009/09/01 09:44:04 | 000,354,816 | ---- | C] () -- C:\Windows\System32\pythoncom26.dll
[2009/09/01 09:44:04 | 000,108,032 | ---- | C] () -- C:\Windows\System32\pywintypes26.dll
[2009/08/06 17:59:05 | 000,659,538 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009/08/06 17:59:05 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009/08/06 17:59:05 | 000,131,810 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009/08/06 17:59:05 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009/07/20 15:17:58 | 000,122,880 | ---- | C] () -- C:\Windows\System32\AitVirtualComInstall.exe
[2009/07/20 15:10:48 | 000,307,200 | ---- | C] () -- C:\Windows\System32\InstallVCOM.exe
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/14 00:33:53 | 000,432,880 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,620,814 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,108,034 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009/07/13 20:02:54 | 000,245,248 | ---- | C] () -- C:\Windows\System32\DShowRdpFilter.dll
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2008/05/04 12:39:34 | 000,002,560 | ---- | C] () -- C:\Windows\System32\ViaClassCoInstaller.dll
[2007/10/25 12:26:10 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
 
========== LOP Check ==========
 
[2012/03/01 13:35:48 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\.minecraft
[2011/03/27 09:00:40 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\Auslogics
[2011/03/26 17:16:47 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\Canneverbe_Limited
[2011/03/26 17:16:47 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\Canon
[2011/03/26 17:16:47 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2011/04/04 11:04:14 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\Command and Conquer 4
[2011/08/04 12:19:14 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\DVDVideoSoft
[2011/05/01 12:51:16 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\DVDVideoSoftIEHelpers
[2012/02/15 12:47:40 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\Opera
[2011/03/26 17:17:05 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\PC Suite
[2011/07/08 05:52:06 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\Petroglyph
[2011/03/26 17:17:05 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\Samsung
[2011/08/23 10:08:40 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\TeamViewer
[2012/02/26 12:56:55 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\TS3Client
[2012/02/26 12:54:13 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\ts3overlay
[2011/11/22 09:42:04 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\Ubisoft
[2011/03/26 17:17:05 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\WinBatch
[2011/03/26 17:16:42 | 000,000,000 | ---D | M] -- C:\Users\Susi\AppData\Roaming\_MDLogs
[2011/03/26 17:15:46 | 000,000,000 | ---D | M] -- C:\Users\Tim\AppData\Roaming\PC Suite
[2011/03/26 17:15:46 | 000,000,000 | ---D | M] -- C:\Users\Tim\AppData\Roaming\Samsung
[2011/03/26 17:15:46 | 000,000,000 | ---D | M] -- C:\Users\Tim\AppData\Roaming\Zylom
[2011/03/26 17:47:27 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2011/03/26 17:06:18 | 000,000,000 | ---D | M] -- C:\ProgramData\Arcade Lab
[2011/03/27 07:48:35 | 000,000,000 | ---D | M] -- C:\ProgramData\avg9
[2011/03/26 17:06:35 | 000,000,000 | ---D | M] -- C:\ProgramData\Canneverbe Limited
[2011/03/26 16:54:39 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonBJ
[2011/12/01 02:34:02 | 000,000,000 | ---D | M] -- C:\ProgramData\CanonIJ
[2011/03/26 17:06:39 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonIJEGV
[2011/03/26 17:06:39 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonIJEPPEX
[2011/03/26 17:06:39 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonIJMyPrinter
[2012/03/02 02:51:03 | 000,000,000 | ---D | M] -- C:\ProgramData\CanonIJPLM
[2011/03/26 17:06:40 | 000,000,000 | -H-D | M] -- C:\ProgramData\CanonIJSolutionMenu
[2011/03/26 18:01:49 | 000,000,000 | -H-D | M] -- C:\ProgramData\Common Files
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2011/03/26 17:47:27 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2011/06/22 21:20:38 | 000,000,000 | ---D | M] -- C:\ProgramData\Electronic Arts
[2011/03/26 17:47:27 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2011/03/26 17:06:52 | 000,000,000 | ---D | M] -- C:\ProgramData\Oberon Media
[2011/03/26 17:06:54 | 000,000,000 | ---D | M] -- C:\ProgramData\PC Suite
[2011/03/26 17:06:54 | 000,000,000 | ---D | M] -- C:\ProgramData\PopCap Games
[2011/11/22 09:54:23 | 000,000,000 | ---D | M] -- C:\ProgramData\Solidshield
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2011/03/26 17:47:27 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2011/03/26 17:06:55 | 000,000,000 | ---D | M] -- C:\ProgramData\Temp
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2011/03/26 17:47:27 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2011/03/26 17:06:55 | 000,000,000 | ---D | M] -- C:\ProgramData\WildTangent
[2011/03/26 17:06:55 | 000,000,000 | ---D | M] -- C:\ProgramData\Zylom
[2011/03/26 17:06:55 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011/03/26 17:06:55 | 000,000,000 | ---D | M] -- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2012/03/12 01:29:40 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >
         
Angehängte Dateien
Dateityp: txt OTL.Txt (66,3 KB, 144x aufgerufen)

Alt 18.03.2012, 16:48   #2
markusg
/// Malware-holic
 
AKM Trojaner blockiert PC - Standard

AKM Trojaner blockiert PC



hi
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:
Code:
ATTFilter
:OTL
O4 - HKU\Susi_ON_C..\Run: [K3aRyluP6SiCkoR] C:\Users\Susi\AppData\Roaming\flint4ytw.exe (SearchHelp, Inc)
O4 - HKLM..\Run: [K3aRyluP6SiCkoR] C:\Users\Susi\AppData\Roaming\flint4ytw.exe (SearchHelp, Inc)
O7 - HKU\Susi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\Susi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\Susi_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O20 - HKLM Winlogon: Shell - (C:\Users\Susi\AppData\Roaming\flint4ytw.exe) - C:\Users\Susi\AppData\Roaming\flint4ytw.exe (SearchHelp, Inc)
O20 - HKLM Winlogon: UserInit - (C:\Users\Susi\AppData\Roaming\flint4ytw.exe) - C:\Users\Susi\AppData\Roaming\flint4ytw.exe (SearchHelp, Inc)
O20 - HKU\Susi_ON_C Winlogon: Shell - (C:\Users\Susi\AppData\Roaming\flint4ytw.exe) - C:\Users\Susi\AppData\Roaming\flint4ytw.exe (SearchHelp, Inc)
O20 - HKU\Susi_ON_C Winlogon: UserInit - (C:\Users\Susi\AppData\Roaming\flint4ytw.exe) - C:\Users\Susi\AppData\Roaming\flint4ytw.exe (SearchHelp, Inc)
:Files
C:\Users\Susi\AppData\Roaming\flint4ytw.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]
         
dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.


falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!




Drücke bitte die + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus
__________________

__________________

Antwort

Themen zu AKM Trojaner blockiert PC
abgesicherter, abgesicherter modus, abgesicherter modus geht nicht, akm trojaner, blockiert, c:\windows\system32\cmd.exe, cdburnerxp, conduit, disabletaskmgr, fenster, geht nicht, microsoft security, modus, otlpe, scan, security scan, tool, troja, trojaner, version=1.0, youtube downloader



Ähnliche Themen: AKM Trojaner blockiert PC


  1. Virus / Trojaner blockiert Avira "...wurde durch eine Gruppenrichtlinie blockiert"
    Log-Analyse und Auswertung - 19.03.2014 (7)
  2. GVU Trojaner blockiert PC
    Plagegeister aller Art und deren Bekämpfung - 05.07.2013 (19)
  3. 50-€-Trojaner, Windows 7 blockiert!
    Log-Analyse und Auswertung - 01.04.2012 (6)
  4. 50€ Trojaner, Windows blockiert
    Plagegeister aller Art und deren Bekämpfung - 29.03.2012 (6)
  5. Window blockiert, 50€ Trojaner
    Plagegeister aller Art und deren Bekämpfung - 28.03.2012 (13)
  6. Windowssystem blockiert, Trojaner
    Plagegeister aller Art und deren Bekämpfung - 04.03.2012 (14)
  7. Trojaner Windows blockiert
    Log-Analyse und Auswertung - 23.02.2012 (32)
  8. Pc wird blockiert: Aus Sicherheitsgründen wurde ihr Windows System blockiert.....
    Log-Analyse und Auswertung - 29.12.2011 (19)
  9. Screen durch unbekanntes Programm blockiert; Taskmgr und Regedit blockiert.
    Plagegeister aller Art und deren Bekämpfung - 25.12.2011 (14)
  10. PC bzw.Screen durch Virus/Malware blockiert; Taskmgr und Regedit blockiert nur MS-Dos funktioniert
    Plagegeister aller Art und deren Bekämpfung - 24.12.2011 (14)
  11. Screen durch unbekanntes Programm blockiert; Taskmgr und Regedit blockiert.
    Plagegeister aller Art und deren Bekämpfung - 23.12.2011 (2)
  12. Pc wird blockiert: Aus Sicherheitsgründen wurde ihr Windows System blockiert.....
    Plagegeister aller Art und deren Bekämpfung - 12.12.2011 (7)
  13. BKA Trojaner blockiert alles
    Plagegeister aller Art und deren Bekämpfung - 09.08.2011 (1)
  14. Trojaner blockiert Normalmodus
    Plagegeister aller Art und deren Bekämpfung - 24.08.2010 (6)
  15. Trojaner blockiert Browser und dll's
    Plagegeister aller Art und deren Bekämpfung - 24.03.2010 (1)
  16. Sämtliche Antivirensoftware wird blockiert + Sites mit hijackthis werden blockiert +
    Log-Analyse und Auswertung - 17.01.2010 (3)
  17. Browser blockiert und auch Antivir Update blockiert
    Plagegeister aller Art und deren Bekämpfung - 16.09.2009 (1)

Zum Thema AKM Trojaner blockiert PC - Hallo, habe leider auch den AKM Trojaner auf meinem PC. Abgesicherter Modus geht nicht *AKM Fenster*, habe daher mit dem OTLPE Tool einen Scan durchgefuehrt. Anbei das OTl Log. Danke - AKM Trojaner blockiert PC...
Archiv
Du betrachtest: AKM Trojaner blockiert PC auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.