BKA Trojaner - PC komplett gesperrt

GoTost · 01.10.2012, 12:53

Liebe Forengemeinde,

im Moment scheint der BKA-Trojaner wieder seine Kreise zu ziehen und ich habe das "Glück" mir diesen Plagegeist zu fangen. Leider auch in einer sehr hartnäckigen Version.
Folgendes Problem: Der PC bootet normal und eine Art Windows-IE-Explorerfenster öffnet sich, wo sich bei vorhandener Internetverbindung die bekannte BK-Seite mit "Ihr PC ist gesperrt blabla " öffnet.
Ich hab keinerlei Zugriff mehr auf den desktop, das Startmenü oder sonstige Windowsanwendungen.
Was ich bisher versucht habe:
- Windows im abgesicherten Modus starten --> Problem nach wie vor
- Kaspersky RescueCD mit Windowsunlocker einlegen und von dieser booten lassen. Nach über 2 Stunden Bootvorgang konnte noch immer nicht die Textversion gestartet werden.
- Versuch OTL per CD zu starten --> Bluescreen mit "A problem has been detected and windows has been shut down...
Ich bin ziemlich ratlos was ich tun soll. Bzw. was außer PC wegschmeißen kann ich überhaupt noch machen ^^
Vielen Dank für eure Hilfe. Grüße

Chris4You · 01.10.2012, 13:05

Hi,

hmm, probieren wir mal ob Du in den abgesicherten Modus mit Eingabeaufforderung kommst...

Downloade dir bitte srep.exe und speichere diese auf einen USB Stick.
Wichtig: Nicht in einen Ordner speichern.

Starte den infizierten Rechner neu auf.
Während dem Hochfahren drücke mehrmals die F8 Taste. Danach solltest Du einige Optionen zur Auswahl haben. Navigiere mit den Pfeiltasten zu Abgesicherter Modus mit Eingabeaufforderung und drücke Enter
** Hinweis: Es kann sein, dass eine andere F Taste gedrückt werden muss, um in die Startoptionen zu kommen.
Logge dich nun in das infizierte Benutzerkonto ein.
Schließe den USB Stick an den infizierten Rechner an.
Nun ist etwas Handarbeit gefragt.
- Du musst zuerst heraus finden, welchen Laufwerksbuchstaben der USB Stick hat.
- Dazu gib bitte einfach E: ein und drücke Enter. Sollte folgende Meldung kommen.
  
  Zitat:
  
  Das System kann das angegeben Laufwerk nicht finden
  
  versuche einen anderen Laufwerksbuchstaben. ( z.B F: )
Sobald Du den richtigen Laufwerksbuchstaben gefunden hast, gib folgendes ein und drücke Enter.
start srep.exe
Drücke nun auf Scan.
Lass das Tool in Ruhe laufen. Der Rechner wird automatisch neu starten.

Auf deinen USB Stick befindet sich eine shell.txt. Bitte poste diese in deiner nächsten Antwort.

chris

GoTost · 01.10.2012, 13:14

Hallo,
ich sehe nach Ausführung und automatischem Neustart zumindest schon mal ein Teil meines Desktop wieders aber ohne Desktopsymbole^^
Hier das File:

WIN_7 X86 Service Pack 1
Running from H:\

HKLM\..\Winlogon; Shell = Explorer.exe [ Microsoft Corporation ]
.
.
.
Modified HKCU shell extension. Current Shell File = C:\Users\Stefan Sommer\AppData\Roaming\wsf3CmCT.exe
File C:\Users\Stefan Sommer\AppData\Roaming\wsf3CmCT.exe moved to H:\\infected or not found

[System Process]
System
smss.exe
csrss.exe
csrss.exe
wininit.exe
services.exe
winlogon.exe
lsass.exe
lsm.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
cmd.exe
conhost.exe
ctfmon.exe
WmiPrvSE.exe
srep.exe

HKLM\..\Run [avgnt] = "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
HKLM\..\Run [USB3MON] = "C:\Program Files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"
HKLM\..\Run [Adobe ARM] = "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
HKLM\..\Run [APSDaemon] = "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM\..\Run [iTunesHelper] = "D:\iTunes\iTunesHelper.exe"
HKLM\..\Run [jICc7n9BYxBTRVw] = C:\Users\Stefan Sommer\AppData\Roaming\wsf3CmCT.exe

HKCU\..\Run [SpybotSD TeaTimer] = D:\Spybot - Search & Destroy\TeaTimer.exe
HKCU\..\Run [MobileDocuments] = C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
HKCU\..\Run [Sidebar] = C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
HKCU\..\Run [jICc7n9BYxBTRVw] = C:\Users\Stefan Sommer\AppData\Roaming\wsf3CmCT.exe

HKU\.DEFAULT\..\Winlogon; Shell =
HKU\S-1-5-19\..\Winlogon; Shell =
HKU\S-1-5-20\..\Winlogon; Shell =
HKU\S-1-5-21-4025550886-2489922206-3517704888-1000\..\Winlogon; Shell = explorer.exe
HKU\S-1-5-21-4025550886-2489922206-3517704888-1000_Classes\..\Winlogon; Shell =
HKU\S-1-5-18\..\Winlogon; Shell =

HKU\S-1-5-19\..\Run [Sidebar] = %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\..\Run [Sidebar] = %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-4025550886-2489922206-3517704888-1000\..\Run [SpybotSD TeaTimer] = D:\Spybot - Search & Destroy\TeaTimer.exe
HKU\S-1-5-21-4025550886-2489922206-3517704888-1000\..\Run [MobileDocuments] = C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
HKU\S-1-5-21-4025550886-2489922206-3517704888-1000\..\Run [Sidebar] = C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
HKU\S-1-5-21-4025550886-2489922206-3517704888-1000\..\Run [jICc7n9BYxBTRVw] = C:\Users\Stefan Sommer\AppData\Roaming\wsf3CmCT.exe

==== FINISH 01.10-16.10 ====

Chris4You · 01.10.2012, 13:26

Hi,

ok, kannst Du jetzt OTL ausführen?

OTL
Lade Dir OTL von Oldtimer herunter (http://filepony.de/download-otl/) und speichere es auf Deinem Desktop

Doppelklick auf die OTL.exe

Vista/Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen

Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output

Unter Extra Registry, wähle bitte Use SafeList

Klicke nun auf Run Scan links oben

Wenn der Scan beendet wurde werden 2 Logfiles erstellt (OTL.TXT und EXTRAS.TXT)

Poste die Logfiles hier in den Thread

chris

GoTost · 01.10.2012, 13:33

Ich kann OTL zwar jetzt starten, aber keinen Scan durchführen. da kommt die Fehlermeldung:
Access violation at Adress CCCC0460. Read od adress CCCC0460
Habe OTL.exe auch als Administrator ausgeführt.

Habe es mittlerweile ausgeführt bekommen. Hierzu habe ich aber wieder die Bootfähige CD mit OTL rausgekramt und vorher in BIOS AHCI auf IDE umgestellt. Jetzt wird mein System gescannt.

Chris4You · 01.10.2012, 14:07

Hi,

Mist...

Malwarebytes Antimalware (MAM)
Anleitung&Download hier: http://www.trojaner-board.de/51187-m...i-malware.html
Falls der Download nicht klappt, bitte hierüber eine generische Version runterladen:
http://filepony.de/download-chameleon/
Danach bitte update der Signaturdateien (Reiter "Aktualisierungen" -> Suche nach Aktualisierungen")
Fullscan und alles bereinigen lassen! Log posten.

Erstelle ein Hijackthis-Logfile:
Lade/entpacke HijackThis in einen extra Ordner und folge den Anweisungen des Links...

chris

GoTost · 01.10.2012, 15:20

Würde ich ja gerne installieren, aber es geht nicht ^^
Ich komme nicht mehr in Windows rein.
Habe hier mal die OTL-Dateien, welche ich über die Rescue-OTL-CD-Version erstellt habe:OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 10/1/2012 5:58:28 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Windows 7 Professional Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 92.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = G: | %SystemRoot% = G:\Windows | %ProgramFiles% = G:\Program Files
Drive C: | 2.00 Gb Total Space | 1.98 Gb Free Space | 99.23% Space Free | Partition Type: FAT
Drive D: | 199.09 Gb Total Space | 191.97 Gb Free Space | 96.43% Space Free | Partition Type: NTFS
Drive E: | 998.72 Mb Total Space | 996.52 Mb Free Space | 99.78% Space Free | Partition Type: FAT
Drive F: | 979.73 Mb Total Space | 535.38 Mb Free Space | 54.64% Space Free | Partition Type: FAT
Drive G: | 236.47 Gb Total Space | 202.74 Gb Free Space | 85.73% Space Free | Partition Type: NTFS
Drive H: | 244.14 Gb Total Space | 220.36 Gb Free Space | 90.26% Space Free | Partition Type: NTFS
Drive I: | 488.28 Gb Total Space | 480.75 Gb Free Space | 98.46% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- G:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- G:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "D:\Office 2010\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "D:\Office 2010\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "D:\Tools\VLC Player\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with Paint Shop Pro 9] -- "D:\PaintshopPro 9\\Paint Shop Pro 9.exe" "/Browse" "%L" (Jasc Software, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "D:\Tools\VLC Player\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\Tools\Orbitdownloader\orbitdm.exe" = D:\Tools\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"D:\Tools\Orbitdownloader\orbitnet.exe" = D:\Tools\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0F6F6876-6334-4977-B5DD-CFC12E193420}" = iTunes
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{240C3DDD-C5E9-4029-9DF7-95650D040CF2}" = Intel(R) USB 3.0 eXtensible Host Controller Driver
"{269011F2-4DE0-428F-9525-B9877A4812DB}" = NetObjects Fusion 10.0
"{26A24AE4-039D-4CA4-87B4-2F83217005FF}" = Java(TM) 7 Update 5
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DECD372-76A1-4483-BF10-B547790A3261}" = ON_OFF Charge B11.1102.1
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{63EC2120-1742-4625-AA47-C6A8AEC9C64C}" = Apple Application Support
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72CD4C5F-AB0B-4814-8780-9A4F26A2086B}" = Presto! PageManager 7.12.03
"{72F0172C-6D1D-470E-9298-A3A1A6530CFB}" = Origin8
"{777afb2a-98e5-4f14-b455-378a925cae15}.sdb" = CVE-2012-4969
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79155F2B-9895-49D7-8612-D92580E0DE5B}" = Bonjour
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{880A0DCF-E8C2-11D9-AAFD-0050BA1ACA6F}" = QLink
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.PROPLUSR_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{91140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{A912021A-FEDD-4DA3-8DB4-245EBDA84778}" = OriginPro 8G
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.16.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{D4DDFAA1-EC37-4529-AD5B-A433ADE68662}" = Apple Mobile Device Support
"{DA7DF8E2-4B8F-4286-97FE-DE3FFFE9B728}" = iCloud
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DDEDAF6C-488E-4CDA-8276-1CCF5F3C5C32}" = Command & Conquer 3
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F843C6A3-224D-4615-94F8-3C461BD9AEA0}" = Jasc Paint Shop Pro 9
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"7-Zip" = 7-Zip 9.20
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Ahnenblatt_is1" = Ahnenblatt 2.71
"Aspell" = Aspell Data
"Aspell6-Dictionary-de" = Aspell 0.6 Dictionary (Language: de)
"Aspell6-Dictionary-en" = Aspell 0.6 Dictionary (Language: en)
"Avira AntiVir Desktop" = Avira Free Antivirus
"CCleaner" = CCleaner
"Derive 6 Demo" = Derive 6 Demo
"Free Studio_is1" = Free Studio version 5.6.3.706
"Free YouTube Download_is1" = Free YouTube Download version 3.1.37.918
"GPL Ghostscript 9.05" = GPL Ghostscript
"GSview 5.0" = GSview 5.0
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"Lexmark_HostCD" = Lexmark Software deinstallieren
"LyX" = LyX 1.6.9-2
"LyX20" = LyX 2.0.4
"Maple 12" = Maple 12
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"MiKTeX 2.9" = MiKTeX 2.9
"Mozilla Firefox 15.0.1 (x86 en-US)" = Mozilla Firefox 15.0.1 (x86 en-US)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.PROPLUSR" = Microsoft Office Professional Plus 2010
"Orbit_is1" = Orbit Downloader
"PDFTK Builder_is1" = PDFTK Builder 3.5.3
"VLC media player" = VLC media player 2.0.3
 
< End of report >

--- --- ---

Und die zweite:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 10/1/2012 5:58:28 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Windows 7 Professional Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 92.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = G: | %SystemRoot% = G:\Windows | %ProgramFiles% = G:\Program Files
Drive C: | 2.00 Gb Total Space | 1.98 Gb Free Space | 99.23% Space Free | Partition Type: FAT
Drive D: | 199.09 Gb Total Space | 191.97 Gb Free Space | 96.43% Space Free | Partition Type: NTFS
Drive E: | 998.72 Mb Total Space | 996.52 Mb Free Space | 99.78% Space Free | Partition Type: FAT
Drive F: | 979.73 Mb Total Space | 535.38 Mb Free Space | 54.64% Space Free | Partition Type: FAT
Drive G: | 236.47 Gb Total Space | 202.74 Gb Free Space | 85.73% Space Free | Partition Type: NTFS
Drive H: | 244.14 Gb Total Space | 220.36 Gb Free Space | 90.26% Space Free | Partition Type: NTFS
Drive I: | 488.28 Gb Total Space | 480.75 Gb Free Space | 98.46% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012/09/18 09:40:13 | 000,250,568 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- G:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/08/17 04:09:33 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand] -- G:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2012/07/27 16:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto] -- G:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/07/18 12:04:33 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- G:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012/07/18 12:04:23 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- G:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/05/14 20:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto] -- G:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012/01/10 10:09:30 | 000,027,760 | ---- | M] (VIA Technologies, Inc.) [Auto] -- G:\Windows\System32\ViakaraokeSrv.exe -- (VIAKaraokeService)
SRV - [2011/12/16 06:30:38 | 000,277,784 | ---- | M] (Intel Corporation) [Auto] -- G:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2011/11/29 14:04:56 | 000,013,592 | ---- | M] (Intel Corporation) [Auto] -- G:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2010/12/27 17:50:30 | 031,124,344 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Office 2010\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2010/04/06 10:30:38 | 000,031,272 | ---- | M] () [On_Demand] -- G:\Windows\System32\AppleChargerSrv.exe -- (AppleChargerSrv)
SRV - [2009/07/13 21:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand] -- G:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- G:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand] -- G:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand] -- G:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009/01/26 09:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto] -- D:\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (gdrv)
DRV - [2012/07/18 12:04:42 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System] -- G:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012/07/18 12:04:42 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto] -- G:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012/07/18 12:04:42 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System] -- G:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2012/05/15 06:26:00 | 011,354,944 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- G:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2012/04/18 13:08:04 | 000,148,800 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- G:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2012/01/27 05:39:34 | 000,791,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- G:\Windows\System32\drivers\iusb3xhc.sys -- (iusb3xhc) Intel(R)
DRV - [2012/01/27 05:39:34 | 000,348,440 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- G:\Windows\System32\drivers\iusb3hub.sys -- (iusb3hub) Intel(R)
DRV - [2012/01/27 05:39:34 | 000,013,592 | ---- | M] (Intel Corporation) [Kernel | Boot] -- G:\Windows\System32\drivers\iusb3hcs.sys -- (iusb3hcs) Intel(R)
DRV - [2012/01/10 10:09:22 | 001,822,832 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand] -- G:\Windows\System32\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV - [2011/11/09 18:52:02 | 000,046,080 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- G:\Windows\System32\drivers\HECI.sys -- (MEI) Intel(R)
DRV - [2011/11/02 04:48:36 | 000,019,056 | ---- | M] () [Kernel | System] -- G:\Windows\System32\drivers\AppleCharger.sys -- (AppleCharger)
DRV - [2011/08/11 18:54:02 | 000,088,176 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- G:\Windows\System32\drivers\L1C62x86.sys -- (L1C)
DRV - [2010/11/19 22:30:16 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- G:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010/11/19 22:30:16 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot] -- G:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010/11/19 22:30:16 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- G:\Windows\system32\drivers\storvsc.sys -- (storvsc)
DRV - [2010/11/19 20:24:42 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- G:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/19 19:59:46 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- G:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/11/19 19:14:46 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- G:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010/11/19 19:14:42 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- G:\Windows\system32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010/06/17 09:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- G:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
 
 
 
IE - HKU\Stefan_Sommer_ON_G\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/
IE - HKU\Stefan_Sommer_ON_G\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Stefan_Sommer_ON_G\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Stefan_Sommer_ON_G\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3C 88 96 50 BA 7B CD 01  [binary data]
IE - HKU\Stefan_Sommer_ON_G\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Stefan_Sommer_ON_G\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.t-online.de/"
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: G:\Windows\System32\Macromed\Flash\NPSWF32_11_4_402_265.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: G:\Windows\System32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: G:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: G:\Windows\System32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\Office 2010\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\Office 2010\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: G:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: G:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: G:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: D:\Mozilla Firefox\components [2012/09/18 09:28:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: D:\Mozilla Firefox\plugins
 
[2012/09/18 09:28:31 | 000,000,000 | ---D | M] (No name found) -- G:\Users\Stefan Sommer\AppData\Roaming\Mozilla\Extensions
[2012/09/30 04:55:42 | 000,000,000 | ---D | M] (No name found) -- G:\Users\Stefan Sommer\AppData\Roaming\Mozilla\Firefox\Profiles\59d2dl65.default\extensions
[2012/09/30 04:55:42 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- G:\Users\Stefan Sommer\AppData\Roaming\Mozilla\Firefox\Profiles\59d2dl65.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
File not found (No name found) -- 
 
O1 HOSTS File: ([2012/09/23 16:10:31 | 000,444,411 | R--- | M]) - G:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1	www.007guard.com
O1 - Hosts: 127.0.0.1	007guard.com
O1 - Hosts: 127.0.0.1	008i.com
O1 - Hosts: 127.0.0.1	www.008k.com
O1 - Hosts: 127.0.0.1	008k.com
O1 - Hosts: 127.0.0.1	www.00hq.com
O1 - Hosts: 127.0.0.1	00hq.com
O1 - Hosts: 127.0.0.1	010402.com
O1 - Hosts: 127.0.0.1	www.032439.com
O1 - Hosts: 127.0.0.1	032439.com
O1 - Hosts: 127.0.0.1	www.0scan.com
O1 - Hosts: 127.0.0.1	0scan.com
O1 - Hosts: 127.0.0.1	www.1000gratisproben.com
O1 - Hosts: 127.0.0.1	1000gratisproben.com
O1 - Hosts: 127.0.0.1	1001namen.com
O1 - Hosts: 127.0.0.1	www.1001namen.com
O1 - Hosts: 127.0.0.1	100888290cs.com
O1 - Hosts: 127.0.0.1	www.100888290cs.com
O1 - Hosts: 127.0.0.1	www.100sexlinks.com
O1 - Hosts: 127.0.0.1	100sexlinks.com
O1 - Hosts: 127.0.0.1	www.10sek.com
O1 - Hosts: 127.0.0.1	10sek.com
O1 - Hosts: 127.0.0.1	www.1-2005-search.com
O1 - Hosts: 127.0.0.1	1-2005-search.com
O1 - Hosts: 127.0.0.1	www.123fporn.info
O1 - Hosts: 15262 more lines...
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - D:\Tools\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - D:\Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - D:\Office 2010\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - G:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [APSDaemon] G:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] G:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [jICc7n9BYxBTRVw]  File not found
O4 - HKLM..\Run: [USB3MON] G:\Program Files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)
O4 - HKU\Stefan_Sommer_ON_G..\Run: [jICc7n9BYxBTRVw]  File not found
O4 - HKU\Stefan_Sommer_ON_G..\Run: [MobileDocuments] G:\Program Files\Common Files\Apple\Internet Services\ubd.exe (Apple Inc.)
O4 - HKU\Stefan_Sommer_ON_G..\Run: [SpybotSD TeaTimer] D:\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\LocalService_ON_G..\RunOnce: [mctadmin] G:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_G..\RunOnce: [mctadmin] G:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\Stefan_Sommer_ON_G\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O8 - Extra context menu item: &Download by Orbit - D:\Tools\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - D:\Tools\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: An OneNote s&enden - D:\Office 2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Do&wnload selected by Orbit - D:\Tools\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - D:\Tools\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Free YouTube Download - G:\Users\Stefan Sommer\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm ()
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - D:\Office 2010\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Office 2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Office 2010\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Office 2010\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - D:\Office 2010\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - G:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - G:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - G:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\Stefan_Sommer_ON_G Winlogon: Shell - (explorer.exe) - G:\Windows\explorer.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - D:\Office 2010\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - G:\autoexec.bat -- [ FAT ]
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - G:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{8366be92-e79d-11e1-9139-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{8366be92-e79d-11e1-9139-806e6f6e6963}\Shell\AutoRun\command - "" = G:\Run.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/10/01 03:27:42 | 000,000,000 | ---D | C] -- G:\Users\Stefan Sommer\AppData\Roaming\Roaming
[2012/09/26 09:37:21 | 000,245,760 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\OxpsConverter.exe
[2012/09/22 04:40:54 | 002,382,848 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\mshtml.tlb
[2012/09/22 04:40:54 | 000,717,824 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\jscript.dll
[2012/09/22 04:40:54 | 000,607,744 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\msfeeds.dll
[2012/09/22 04:40:54 | 000,420,864 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\vbscript.dll
[2012/09/22 04:40:54 | 000,176,640 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\ieui.dll
[2012/09/22 04:40:54 | 000,142,848 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\ieUnatt.exe
[2012/09/22 04:40:54 | 000,065,024 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\jsproxy.dll
[2012/09/22 04:40:53 | 001,800,704 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\jscript9.dll
[2012/09/22 04:40:53 | 001,427,968 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\inetcpl.cpl
[2012/09/22 04:40:53 | 000,231,936 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\url.dll
[2012/09/20 11:11:48 | 000,000,000 | ---D | C] -- G:\Windows\pss
[2012/09/18 09:40:16 | 000,000,000 | ---D | C] -- G:\Users\Stefan Sommer\AppData\Local\Macromedia
[2012/09/18 09:28:20 | 000,000,000 | ---D | C] -- G:\Users\Stefan Sommer\AppData\Roaming\Mozilla
[2012/09/18 09:28:20 | 000,000,000 | ---D | C] -- G:\Users\Stefan Sommer\AppData\Local\Mozilla
[2012/09/17 04:20:22 | 000,000,000 | ---D | C] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFTK Builder
[2012/09/14 11:23:49 | 000,000,000 | ---D | C] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/09/14 07:31:00 | 000,000,000 | ---D | C] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012/09/14 07:30:58 | 000,000,000 | ---D | C] -- G:\Program Files\QuickTime
[2012/09/14 07:29:44 | 000,000,000 | ---D | C] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/09/14 07:29:35 | 000,000,000 | ---D | C] -- G:\Program Files\iPod
[2012/09/14 07:29:35 | 000,000,000 | ---D | C] -- G:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2012/09/12 02:41:23 | 000,490,496 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\d3d10level9.dll
[2012/09/12 02:41:23 | 000,240,496 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\drivers\netio.sys
[2012/09/12 02:41:23 | 000,187,760 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\drivers\FWPKCLNT.SYS
[2012/09/12 02:41:23 | 000,033,280 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\drivers\RNDISMP.sys
[2012/09/08 06:56:43 | 000,000,000 | ---D | C] -- G:\Program Files\Common Files\Bcgsoft
[2012/09/08 06:56:38 | 000,000,000 | ---D | C] -- G:\Users\Stefan Sommer\AppData\Roaming\Genprofi-Stammbaum
[2012/09/08 06:56:37 | 001,009,336 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\mschrt20.ocx
[2012/09/08 06:56:36 | 001,047,552 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\MFC71u.dll
[2012/09/08 06:56:36 | 000,089,088 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\atl71.dll
[2012/09/08 06:56:36 | 000,065,536 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\MFC71DEU.DLL
[2012/09/08 06:56:36 | 000,061,440 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\MFC71FRA.DLL
[2012/09/08 06:53:04 | 000,608,448 | ---- | C] (Microsoft Corporation) -- G:\Windows\System32\comctl32.ocx
[2012/09/08 06:36:20 | 000,000,000 | ---D | C] -- G:\Users\Stefan Sommer\Documents\Ahnenblatt
[2012/09/08 06:36:20 | 000,000,000 | ---D | C] -- G:\Users\Stefan Sommer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ahnenblatt
[2012/09/08 06:36:19 | 000,000,000 | ---D | C] -- G:\Users\Stefan Sommer\AppData\Roaming\Ahnenblatt
[2012/09/06 06:13:07 | 000,000,000 | ---D | C] -- G:\Users\Stefan Sommer\AppData\Roaming\uTorrent
[2012/09/04 04:59:56 | 000,000,000 | ---D | C] -- G:\Users\Stefan Sommer\AppData\Roaming\Canneverbe Limited
[2012/09/04 04:59:56 | 000,000,000 | ---D | C] -- G:\ProgramData\Canneverbe Limited
 
========== Files - Modified Within 30 Days ==========
 
[2012/10/01 10:44:59 | 000,067,584 | --S- | M] () -- G:\Windows\bootstat.dat
[2012/10/01 10:31:47 | 000,699,974 | ---- | M] () -- G:\Windows\System32\perfh007.dat
[2012/10/01 10:31:47 | 000,654,686 | ---- | M] () -- G:\Windows\System32\perfh009.dat
[2012/10/01 10:31:47 | 000,148,770 | ---- | M] () -- G:\Windows\System32\perfc007.dat
[2012/10/01 10:31:47 | 000,121,558 | ---- | M] () -- G:\Windows\System32\perfc009.dat
[2012/10/01 10:18:38 | 000,017,104 | -H-- | M] () -- G:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/10/01 10:18:38 | 000,017,104 | -H-- | M] () -- G:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/10/01 10:11:22 | 2800,324,608 | -HS- | M] () -- G:\hiberfil.sys
[2012/10/01 02:15:18 | 000,457,672 | ---- | M] () -- G:\Windows\System32\FNTCACHE.DAT
[2012/09/30 04:55:41 | 000,000,000 | ---D | M] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2012/09/24 13:17:00 | 000,005,632 | ---- | M] () -- G:\Users\Stefan Sommer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/23 16:10:31 | 000,444,411 | R--- | M] () -- G:\Windows\System32\drivers\etc\hosts
[2012/09/21 02:20:13 | 000,000,884 | ---- | M] () -- G:\Windows\tasks\Adobe Flash Player Updater.job
[2012/09/20 11:11:48 | 000,000,000 | R--D | M] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
[2012/09/18 09:40:13 | 000,696,520 | ---- | M] (Adobe Systems Incorporated) -- G:\Windows\System32\FlashPlayerApp.exe
[2012/09/18 09:40:13 | 000,073,416 | ---- | M] (Adobe Systems Incorporated) -- G:\Windows\System32\FlashPlayerCPLApp.cpl
[2012/09/18 09:28:17 | 000,000,636 | ---- | M] () -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/09/17 04:20:22 | 000,000,000 | ---D | M] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFTK Builder
[2012/09/14 11:31:23 | 000,000,000 | ---- | M] () -- G:\Users\Stefan Sommer\Documents\NEWSOFT
[2012/09/14 11:23:49 | 000,000,969 | ---- | M] () -- G:\Users\Public\Desktop\CCleaner.lnk
[2012/09/14 11:23:49 | 000,000,000 | ---D | M] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012/09/14 07:31:00 | 000,000,000 | ---D | M] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2012/09/14 07:29:44 | 000,001,449 | ---- | M] () -- G:\Users\Public\Desktop\iTunes.lnk
[2012/09/14 07:29:44 | 000,000,000 | ---D | M] -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012/09/08 18:17:35 | 000,162,500 | -H-- | M] () -- G:\Windows\System32\mlfcache.dat
[2012/09/08 06:36:20 | 000,000,745 | ---- | M] () -- G:\Users\Stefan Sommer\Desktop\Ahnenblatt.lnk
 
========== Files Created - No Company Name ==========
 
[2012/10/01 02:15:11 | 000,457,672 | ---- | C] () -- G:\Windows\System32\FNTCACHE.DAT
[2012/09/18 09:40:14 | 000,000,884 | ---- | C] () -- G:\Windows\tasks\Adobe Flash Player Updater.job
[2012/09/18 09:28:17 | 000,000,636 | ---- | C] () -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012/09/14 11:31:23 | 000,000,000 | ---- | C] () -- G:\Users\Stefan Sommer\Documents\NEWSOFT
[2012/09/14 07:29:44 | 000,001,449 | ---- | C] () -- G:\Users\Public\Desktop\iTunes.lnk
[2012/09/08 16:27:34 | 000,005,632 | ---- | C] () -- G:\Users\Stefan Sommer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/09/08 06:36:20 | 000,000,745 | ---- | C] () -- G:\Users\Stefan Sommer\Desktop\Ahnenblatt.lnk
[2012/09/05 07:32:02 | 000,162,500 | -H-- | C] () -- G:\Windows\System32\mlfcache.dat
[2012/08/18 05:58:53 | 000,040,960 | ---- | C] () -- G:\Windows\System32\IPPCPUID.DLL
[2012/08/18 05:58:47 | 000,028,672 | ---- | C] () -- G:\Windows\hookdllX.dll
[2012/08/18 05:58:46 | 000,011,776 | ---- | C] () -- G:\Windows\System32\pmsbfn32.dll
[2012/08/17 04:02:21 | 000,028,672 | ---- | C] () -- G:\Windows\System32\nnr.dll
[2012/08/17 03:54:04 | 000,212,992 | ---- | C] () -- G:\Windows\System32\WMIMPLEX.dll
[2012/08/17 03:54:04 | 000,040,960 | ---- | C] () -- G:\Windows\System32\maplec.dll
[2012/08/17 03:54:04 | 000,020,480 | ---- | C] () -- G:\Windows\System32\maplecompat.dll
[2012/08/16 11:34:04 | 000,066,048 | ---- | C] () -- G:\Windows\System32\PrintBrmUi.exe
[2012/08/16 11:34:03 | 000,252,928 | ---- | C] () -- G:\Windows\System32\DShowRdpFilter.dll
[2012/08/16 09:03:00 | 000,031,272 | ---- | C] () -- G:\Windows\System32\AppleChargerSrv.exe
[2012/08/16 09:03:00 | 000,019,056 | ---- | C] () -- G:\Windows\System32\drivers\AppleCharger.sys
[2012/08/16 08:59:51 | 000,000,010 | ---- | C] () -- G:\Windows\GSetup.ini
[2012/08/16 08:33:04 | 002,621,723 | ---- | C] () -- G:\Windows\System32\nvcoproc.bin
[2012/05/14 20:21:50 | 000,423,744 | ---- | C] () -- G:\Windows\System32\nvStreaming.exe
[2009/08/27 03:04:14 | 000,207,400 | R--- | C] () -- G:\Windows\GSetup.exe
[2009/07/14 04:47:43 | 000,699,974 | ---- | C] () -- G:\Windows\System32\perfh007.dat
[2009/07/14 04:47:43 | 000,295,922 | ---- | C] () -- G:\Windows\System32\perfi007.dat
[2009/07/14 04:47:43 | 000,148,770 | ---- | C] () -- G:\Windows\System32\perfc007.dat
[2009/07/14 04:47:43 | 000,038,104 | ---- | C] () -- G:\Windows\System32\perfd007.dat
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- G:\Windows\bootstat.dat
[2009/07/13 22:05:48 | 000,654,686 | ---- | C] () -- G:\Windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- G:\Windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,121,558 | ---- | C] () -- G:\Windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- G:\Windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- G:\Windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- G:\Windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- G:\Windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- G:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- G:\Windows\System32\BWContextHandler.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- G:\Windows\System32\mlang.dat
 
========== LOP Check ==========
 
[2012/09/14 07:29:43 | 000,000,000 | ---D | M] -- G:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
[2012/08/16 08:30:30 | 000,000,000 | -HSD | M] -- G:\ProgramData\Anwendungsdaten
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- G:\ProgramData\Application Data
[2012/09/04 04:59:56 | 000,000,000 | ---D | M] -- G:\ProgramData\Canneverbe Limited
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- G:\ProgramData\Desktop
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- G:\ProgramData\Documents
[2012/08/16 08:30:30 | 000,000,000 | -HSD | M] -- G:\ProgramData\Dokumente
[2012/08/16 08:30:30 | 000,000,000 | -HSD | M] -- G:\ProgramData\Favoriten
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- G:\ProgramData\Favorites
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- G:\ProgramData\Start Menu
[2012/08/16 08:30:30 | 000,000,000 | -HSD | M] -- G:\ProgramData\Startmenü
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- G:\ProgramData\Templates
[2012/08/17 03:14:42 | 000,000,000 | ---D | M] -- G:\ProgramData\UD1
[2012/08/16 08:30:30 | 000,000,000 | -HSD | M] -- G:\ProgramData\Vorlagen
[2012/08/16 11:20:41 | 000,000,000 | ---D | M] -- G:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2012/08/16 09:00:53 | 000,000,000 | -H-D | M] -- G:\ProgramData\{8533ADFA-85F0-4dc1-946A-2A0BA58E78E3}
[2009/07/14 00:53:46 | 000,030,364 | ---- | M] () -- G:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >

--- --- ---

Chris4You · 02.10.2012, 06:59

Hi,

was meinst Du "Komme nicht mehr in Windows rein"; Ist der Desktop da, mit oder ohne Icons? Kannst Du einen Explorer öffnen (Windowstaste+E)?
Oder kommt es bei der Installation zu einem Fehler?

Fix für OTL:

Doppelklick auf die OTL.exe, um das Programm auszuführen.

Vista/Win7-User bitte per Rechtsklick und "Ausführen als Administrator" starten.

Kopiere den Inhalt der folgenden Codebox komplett in die OTL-Box unter "Custom Scan/Fixes"

Code:

ATTFilter

:OTL
O4 - HKLM..\Run: [jICc7n9BYxBTRVw]  File not found
O4 - HKU\Stefan_Sommer_ON_G..\Run: [jICc7n9BYxBTRVw]  File not found

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = dword:0x01

:Commands
[emptytemp]
[Reboot]

Den roten Run Fixes! Button anklicken.

Bitte alles aus dem Ergebnisfenster (Results) herauskopieren.

Eine Kopie eines OTL-Fix-Logs wird in einer Textdatei in folgendem Ordner gespeichert:

%systemroot%\_OTL

Unhide
Lade Dir unhide von folgender Adresse runter und dann per Doppelklick als Admin ausführen:
http://filepony.de/download-unhide/
Es werden alle versteckten Dateien sichtbar gemacht, ggf. welche die versteckt sein sollten wieder unsichtbar machen (Auswählen im Explorer->Eigenschaften->versteckt)

Bitte folgende Files prüfen:

Dateien Online überprüfen lassen:

Als erstes versteckte Dateien anzeigen lassen! (nur Punkt 1 durchführen!)

Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:

Code:

ATTFilter

G:\Windows\GSetup.exe
G:\Windows\System32\AppleChargerSrv.exe

Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)

Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.

Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

MBR-Check
Lade Dir http://ad13.geekstogo.com/MBRCheck.exe und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.

Vista und Win7 User mit Rechtsklick "als Administrator starten"

Das Tool braucht nur eine Sekunde.

Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste bitte den Inhalt des .txt Dokumentes

chris

BKA Trojaner - PC komplett gesperrt

Plagegeister aller Art und deren Bekämpfung: BKA Trojaner - PC komplett gesperrt