Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: laptop von der österreichischen polizei gesperrt!

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 22.05.2013, 20:14   #16
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
laptop von der österreichischen polizei gesperrt! - Standard

laptop von der österreichischen polizei gesperrt!



Nicht irgendeinen Windows-Ordner, du musst den Windows-Ordner deiner Windows-Installation nehmen - steht das nicht in der Anleitung?!
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 26.05.2013, 08:20   #17
karly
 
laptop von der österreichischen polizei gesperrt! - Standard

laptop von der österreichischen polizei gesperrt!



Bei mir wurde aber nur OTL.txt erstellt. Wie erstellt man EXTRAS.txt?

Hier jedenfalls mal das OTL.txt:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 5/26/2013 3:21:32 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium  (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 75.27 Mb Free Space | 75.28% Space Free | Partition Type: NTFS
Drive E: | 546.25 Gb Total Space | 481.89 Gb Free Space | 88.22% Space Free | Partition Type: NTFS
Drive F: | 48.83 Gb Total Space | 6.77 Gb Free Space | 13.87% Space Free | Partition Type: NTFS
Drive G: | 7.45 Gb Total Space | 7.45 Gb Free Space | 100.00% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010/09/22 21:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/03/14 12:13:28 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- E:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/14 10:05:23 | 002,469,992 | ---- | M] () [Auto] -- E:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe -- (BrowserProtect)
SRV - [2011/10/01 03:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 03:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/07/31 13:09:14 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- E:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/05/10 08:56:47 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- E:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/03/18 16:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/03 23:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto] -- E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2009/12/10 02:48:26 | 002,320,920 | ---- | M] (Intel Corporation) [Auto] -- E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2009/12/10 02:48:24 | 000,268,824 | ---- | M] (Intel Corporation) [Auto] -- E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009/11/07 06:46:52 | 000,020,480 | ---- | M] (X10) [Auto] -- E:\Program Files (x86)\Common Files\X10\Common\X10nets.exe -- (x10nets)
SRV - [2009/10/22 20:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) [On_Demand] -- E:\Program Files (x86)\Launch Manager\WisLMSvc.exe -- (WisLMSvc)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007/07/24 06:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- E:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011/10/01 03:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011/10/01 03:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011/10/01 03:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand] -- E:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011/10/01 03:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011/07/31 13:09:14 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System] -- E:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011/07/31 13:09:14 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto] -- E:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2010/09/30 07:00:06 | 000,180,736 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010/09/30 07:00:06 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010/08/25 14:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010/06/21 09:15:54 | 000,287,232 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010/06/09 08:00:50 | 001,887,528 | ---- | M] (Trident Microsystems, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\TrdCap64.sys -- (TrdCap64)
DRV:64bit: - [2010/05/24 09:46:36 | 000,246,304 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- E:\Windows\System32\Drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010/03/04 11:53:02 | 000,075,816 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2010/03/02 07:25:26 | 001,098,784 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand] -- E:\Windows\System32\drivers\rtl8192se.sys -- (rtl8192se)
DRV:64bit: - [2010/02/26 23:02:12 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\Impcd.sys -- (Impcd)
DRV:64bit: - [2010/02/22 04:09:10 | 000,011,776 | ---- | M] (MBB Incorporated) [Kernel | On_Demand] -- E:\Windows\System32\drivers\massfilter.sys -- (massfilter)
DRV:64bit: - [2010/02/04 07:54:32 | 001,888,864 | ---- | M] (NXP Semiconductors Germany GmbH) [Kernel | On_Demand] -- E:\Windows\System32\drivers\NxpCap64.sys -- (NxpCap64)
DRV:64bit: - [2009/10/12 10:23:22 | 000,114,304 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ewusbdev.sys -- (hwusbdev)
DRV:64bit: - [2009/09/24 05:52:34 | 000,913,888 | ---- | M] (DiBcom SA) [Kernel | On_Demand] -- E:\Windows\System32\drivers\mod77-64.sys -- (mod7764)
DRV:64bit: - [2009/09/17 22:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- E:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:35:42 | 000,187,392 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/05/13 15:47:44 | 000,032,792 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\Drivers\x10ufx2.sys -- (XUIF)
DRV:64bit: - [2009/05/13 15:26:14 | 000,015,896 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\Drivers\x10hid.sys -- (X10Hid)
DRV:64bit: - [2007/07/11 05:09:56 | 000,112,512 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Florian_ON_E\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = Google
IE - HKU\Florian_ON_E\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI
IE - HKU\Florian_ON_E\Software\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\Florian_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKU\Florian_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\LocalService_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
========== FireFox ==========
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\System32\Macromed\Flash\NPSWF64_11_6_602_180.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: E:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer: E:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: E:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: E:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: E:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: E:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{58bd07eb-0ee0-4df0-8121-dc9b693373df}: C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension [2012/12/28 13:30:26 | 000,000,000 | ---D | M]
 
[2012/10/01 09:06:58 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Florian\AppData\Roaming\Mozilla\Extensions
[2012/10/01 09:06:58 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Florian\AppData\Roaming\Mozilla\Extensions\{SbX-155247-9783706842167-stu10}
[2012/12/28 13:30:17 | 000,000,000 | ---D | M] (No name found) -- E:\Program Files (x86)\Mozilla Firefox\extensions
 
O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - E:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (DataMngr) - {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} - E:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\BrowserConnection.dll (Bandoo Media Inc)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - E:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.8.7.2\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (DataMngr) - {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} - E:\Program Files (x86)\Search Results Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media Inc)
O2 - BHO: (Search-Results Toolbar) - {f34c9277-6577-4dff-b2d7-7d58092f272f} - E:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - E:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.8.7.2\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {f34c9277-6577-4dff-b2d7-7d58092f272f} - E:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4:64bit: - HKLM..\Run: [RtHDVBg] E:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] E:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] E:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DATAMNGR] E:\Program Files (x86)\Search Results Toolbar\Datamngr\datamngrUI.exe (Bandoo Media Inc)
O4 - HKLM..\Run: [HotkeyApp] E:\Program Files (x86)\Launch Manager\HotkeyApp.exe (Wistron)
O4 - HKLM..\Run: [LMgrOSD]  File not found
O4 - HKLM..\Run: [LMgrVolOSD] E:\Program Files (x86)\Launch Manager\OSD.exe (Wistron Corp.)
O4 - HKLM..\Run: [NUSB3MON] E:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [Wbutton] E:\Program Files (x86)\Launch Manager\Wbutton.exe (Wistron Corp.)
O4 - HKU\LocalService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_E..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_E..\RunOnce: [mctadmin]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra Button: eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9:64bit: - Extra 'Tools' menuitem : eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra Button: eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra 'Tools' menuitem : eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} hxxp://91.113.220.122/activex/AMC.cab (AxisMediaControlEmb Class)
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll) - E:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\datamngr.dll (Bandoo Media Inc)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll) - E:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\IEBHO.dll (Bandoo Media Inc)
O20 - AppInit_DLLs: (c:\progra~3\browse~1\251005~1.80\{c16c1~1\browse~1.dll) - E:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\Florian_ON_E Winlogon: Shell - (explorer.exe) - E:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKU\Florian_ON_E Winlogon: Shell - (C:\Users\Florian\AppData\Roaming\skype.dat) - E:\Users\Florian\AppData\Roaming\skype.dat ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{15c05717-a038-11e1-9e5c-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15c05717-a038-11e1-9e5c-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{15c05720-a038-11e1-9e5c-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15c05720-a038-11e1-9e5c-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{15ef4256-47f5-11e0-9dd5-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15ef4256-47f5-11e0-9dd5-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{15ef4265-47f5-11e0-9dd5-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15ef4265-47f5-11e0-9dd5-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{15ef4267-47f5-11e0-9dd5-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15ef4267-47f5-11e0-9dd5-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{17f17a45-50b9-11e0-aac0-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{17f17a45-50b9-11e0-aac0-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{17f17a53-50b9-11e0-aac0-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{17f17a53-50b9-11e0-aac0-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{4d9a9eba-2524-11e0-8f53-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{4d9a9eba-2524-11e0-8f53-806e6f6e6963}\Shell\AutoRun\command - "" = E:\cdstart.exe
O33 - MountPoints2\{552b7940-47f9-11e0-8eb8-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{552b7940-47f9-11e0-8eb8-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{552b7942-47f9-11e0-8eb8-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{552b7942-47f9-11e0-8eb8-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{6e7e3b9c-523d-11e0-a8ca-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{6e7e3b9c-523d-11e0-a8ca-485d60465352}\Shell\AutoRun\command - "" = H:\AutoRun.exe
O33 - MountPoints2\{79b6d9a4-b7be-11e1-91ad-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{79b6d9a4-b7be-11e1-91ad-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{84ebdeae-ddac-11e1-aa4b-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{84ebdeae-ddac-11e1-aa4b-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{962c8a44-e2da-11e0-a52c-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{962c8a44-e2da-11e0-a52c-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{983e8907-4dd5-11e2-a5c5-00262dc3534e}\Shell - "" = AutoRun
O33 - MountPoints2\{983e8907-4dd5-11e2-a5c5-00262dc3534e}\Shell\AutoRun\command - "" = E:\cdstart.exe
O33 - MountPoints2\{c04b7e29-bec5-11e1-914e-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{c04b7e29-bec5-11e1-914e-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{c04b7e2b-bec5-11e1-914e-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{c04b7e2b-bec5-11e1-914e-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{e566942f-da2c-11e0-a997-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{e566942f-da2c-11e0-a997-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{ebb4f2fe-70c4-11e0-a6ee-001e101f2500}\Shell - "" = AutoRun
O33 - MountPoints2\{ebb4f2fe-70c4-11e0-a6ee-001e101f2500}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{fdc9e9cd-dadb-11e0-a6c8-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{fdc9e9cd-dadb-11e0-a6c8-485d60465352}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[1 E:\Windows\*.tmp files -> E:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/05/11 04:40:08 | 000,067,584 | --S- | M] () -- E:\Windows\bootstat.dat
[2013/05/11 04:40:04 | 000,001,110 | ---- | M] () -- E:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/11 04:40:03 | 000,000,884 | ---- | M] () -- E:\Windows\tasks\Adobe Flash Player Updater.job
[2013/05/11 04:39:15 | 000,654,852 | ---- | M] () -- E:\Windows\System32\perfh007.dat
[2013/05/11 04:39:15 | 000,616,694 | ---- | M] () -- E:\Windows\System32\perfh009.dat
[2013/05/11 04:39:15 | 000,130,434 | ---- | M] () -- E:\Windows\System32\perfc007.dat
[2013/05/11 04:39:15 | 000,106,816 | ---- | M] () -- E:\Windows\System32\perfc009.dat
[2013/05/11 04:38:23 | 000,000,004 | ---- | M] () -- E:\Users\Florian\AppData\Roaming\skype.ini
[2013/05/11 03:31:16 | 000,001,106 | ---- | M] () -- E:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/11 03:30:21 | 3061,960,704 | -HS- | M] () -- E:\hiberfil.sys
[2013/05/06 11:38:34 | 000,010,096 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/06 11:38:34 | 000,010,096 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/05 09:10:47 | 322,613,881 | ---- | M] () -- E:\Windows\MEMORY.DMP
[2013/04/30 16:12:31 | 000,000,374 | ---- | M] () -- E:\Windows\System32\drivers\etc\hosts.ics
[1 E:\Windows\*.tmp files -> E:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/05/04 18:12:45 | 000,000,004 | ---- | C] () -- E:\Users\Florian\AppData\Roaming\skype.ini
[2012/03/16 10:07:40 | 000,102,400 | ---- | C] () -- E:\Users\Florian\AppData\Roaming\skype.dat
[2011/03/17 13:30:31 | 000,000,400 | ---- | C] () -- E:\Windows\ODBC.INI
[2011/03/16 10:25:13 | 001,527,912 | ---- | C] () -- E:\Windows\SysWow64\PerfStringBackup.INI
[2010/11/03 13:47:42 | 000,000,000 | ---- | C] () -- E:\Windows\Bench32.INI
[2010/11/02 13:04:22 | 000,127,184 | ---- | C] () -- E:\Windows\Unwise.exe
[2010/11/02 13:04:21 | 000,149,504 | ---- | C] () -- E:\Windows\unwise32_setup.exe
[2010/11/02 12:49:13 | 000,451,072 | ---- | C] () -- E:\Windows\SysWow64\ISSRemoveSP.exe
[2010/11/02 12:10:54 | 000,870,560 | ---- | C] () -- E:\Windows\SysWow64\igkrng575.bin
[2010/11/02 12:10:54 | 000,208,896 | ---- | C] () -- E:\Windows\SysWow64\iglhsip32.dll
[2010/11/02 12:10:54 | 000,143,360 | ---- | C] () -- E:\Windows\SysWow64\iglhcp32.dll
[2010/11/02 12:10:54 | 000,104,796 | ---- | C] () -- E:\Windows\SysWow64\igfcg575m.bin
[2010/11/02 12:10:52 | 000,127,868 | ---- | C] () -- E:\Windows\SysWow64\igcompkrng575.bin
[2010/06/08 09:19:24 | 000,692,224 | ---- | C] () -- E:\Windows\SysWow64\libeay32.dll
[2010/06/08 09:19:24 | 000,151,552 | ---- | C] () -- E:\Windows\SysWow64\ssleay32.dll
[2010/04/20 10:31:43 | 000,936,832 | ---- | C] () -- E:\Windows\SysWow64\M2ElevatedCalls.dll
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- E:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- E:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- E:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- E:\Windows\mib.bin
[2009/07/13 20:02:54 | 000,245,248 | ---- | C] () -- E:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- E:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- E:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- E:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- E:\Windows\SysWow64\mlang.dat
[2008/10/07 04:13:30 | 000,197,912 | ---- | C] () -- E:\Windows\SysWow64\physxcudart_20.dll
[2008/10/07 04:13:22 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSwedish.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSpanish.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelPortugese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelKorean.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelJapanese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelGerman.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelFrench.dll
[2003/02/20 12:53:42 | 000,005,702 | ---- | C] () -- E:\Windows\SysWow64\OUTLPERF.INI
 
========== LOP Check ==========
 
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Application Data
[2012/12/28 13:30:02 | 000,000,000 | ---D | M] -- E:\ProgramData\Babylon
[2012/12/02 02:34:48 | 000,000,000 | ---D | M] -- E:\ProgramData\boost_interprocess
[2012/12/28 13:30:25 | 000,000,000 | ---D | M] -- E:\ProgramData\BrowserProtect
[2011/03/17 13:17:26 | 000,000,000 | ---D | M] -- E:\ProgramData\DAEMON Tools Lite
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Documents
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favorites
[2011/03/17 13:40:24 | 000,000,000 | ---D | M] -- E:\ProgramData\mquadr.at
[2011/03/17 13:49:28 | 000,000,000 | ---D | M] -- E:\ProgramData\Partner
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Start Menu
[2010/11/06 11:48:32 | 000,000,000 | ---D | M] -- E:\ProgramData\Temp
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Templates
[2011/04/03 05:23:12 | 000,000,000 | ---D | M] -- E:\ProgramData\VirtualizedApplications
[2010/11/02 13:13:33 | 000,000,000 | ---D | M] -- E:\ProgramData\X10 Settings
[2011/09/08 11:20:06 | 000,000,000 | -H-D | M] -- E:\ProgramData\{6B3B2B58-1531-427B-BBBF-916BC14A9172}
[2013/04/11 10:10:45 | 000,032,640 | ---- | M] () -- E:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >
         
--- --- ---

Hier jedenfalls mal das OTL.txt:OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 5/26/2013 3:21:32 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium  (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 75.27 Mb Free Space | 75.28% Space Free | Partition Type: NTFS
Drive E: | 546.25 Gb Total Space | 481.89 Gb Free Space | 88.22% Space Free | Partition Type: NTFS
Drive F: | 48.83 Gb Total Space | 6.77 Gb Free Space | 13.87% Space Free | Partition Type: NTFS
Drive G: | 7.45 Gb Total Space | 7.45 Gb Free Space | 100.00% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2010/09/22 21:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/03/14 12:13:28 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- E:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/14 10:05:23 | 002,469,992 | ---- | M] () [Auto] -- E:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe -- (BrowserProtect)
SRV - [2011/10/01 03:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 03:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/07/31 13:09:14 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- E:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/05/10 08:56:47 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- E:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/03/18 16:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/03 23:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto] -- E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2009/12/10 02:48:26 | 002,320,920 | ---- | M] (Intel Corporation) [Auto] -- E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2009/12/10 02:48:24 | 000,268,824 | ---- | M] (Intel Corporation) [Auto] -- E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009/11/07 06:46:52 | 000,020,480 | ---- | M] (X10) [Auto] -- E:\Program Files (x86)\Common Files\X10\Common\X10nets.exe -- (x10nets)
SRV - [2009/10/22 20:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) [On_Demand] -- E:\Program Files (x86)\Launch Manager\WisLMSvc.exe -- (WisLMSvc)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007/07/24 06:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- E:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011/10/01 03:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011/10/01 03:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011/10/01 03:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand] -- E:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011/10/01 03:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011/07/31 13:09:14 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System] -- E:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011/07/31 13:09:14 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto] -- E:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2010/09/30 07:00:06 | 000,180,736 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010/09/30 07:00:06 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010/08/25 14:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010/06/21 09:15:54 | 000,287,232 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010/06/09 08:00:50 | 001,887,528 | ---- | M] (Trident Microsystems, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\TrdCap64.sys -- (TrdCap64)
DRV:64bit: - [2010/05/24 09:46:36 | 000,246,304 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- E:\Windows\System32\Drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010/03/04 11:53:02 | 000,075,816 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2010/03/02 07:25:26 | 001,098,784 | ---- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand] -- E:\Windows\System32\drivers\rtl8192se.sys -- (rtl8192se)
DRV:64bit: - [2010/02/26 23:02:12 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\Impcd.sys -- (Impcd)
DRV:64bit: - [2010/02/22 04:09:10 | 000,011,776 | ---- | M] (MBB Incorporated) [Kernel | On_Demand] -- E:\Windows\System32\drivers\massfilter.sys -- (massfilter)
DRV:64bit: - [2010/02/04 07:54:32 | 001,888,864 | ---- | M] (NXP Semiconductors Germany GmbH) [Kernel | On_Demand] -- E:\Windows\System32\drivers\NxpCap64.sys -- (NxpCap64)
DRV:64bit: - [2009/10/12 10:23:22 | 000,114,304 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ewusbdev.sys -- (hwusbdev)
DRV:64bit: - [2009/09/24 05:52:34 | 000,913,888 | ---- | M] (DiBcom SA) [Kernel | On_Demand] -- E:\Windows\System32\drivers\mod77-64.sys -- (mod7764)
DRV:64bit: - [2009/09/17 22:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- E:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:35:42 | 000,187,392 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/05/13 15:47:44 | 000,032,792 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\Drivers\x10ufx2.sys -- (XUIF)
DRV:64bit: - [2009/05/13 15:26:14 | 000,015,896 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\Drivers\x10hid.sys -- (X10Hid)
DRV:64bit: - [2007/07/11 05:09:56 | 000,112,512 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Florian_ON_E\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = Google
IE - HKU\Florian_ON_E\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI
IE - HKU\Florian_ON_E\Software\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\Florian_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKU\Florian_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\LocalService_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
========== FireFox ==========
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\System32\Macromed\Flash\NPSWF64_11_6_602_180.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: E:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer: E:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: E:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE:  File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: E:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: E:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: E:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{58bd07eb-0ee0-4df0-8121-dc9b693373df}: C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension [2012/12/28 13:30:26 | 000,000,000 | ---D | M]
 
[2012/10/01 09:06:58 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Florian\AppData\Roaming\Mozilla\Extensions
[2012/10/01 09:06:58 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Florian\AppData\Roaming\Mozilla\Extensions\{SbX-155247-9783706842167-stu10}
[2012/12/28 13:30:17 | 000,000,000 | ---D | M] (No name found) -- E:\Program Files (x86)\Mozilla Firefox\extensions
 
O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - E:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (DataMngr) - {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} - E:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\BrowserConnection.dll (Bandoo Media Inc)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - E:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.8.7.2\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (DataMngr) - {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} - E:\Program Files (x86)\Search Results Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media Inc)
O2 - BHO: (Search-Results Toolbar) - {f34c9277-6577-4dff-b2d7-7d58092f272f} - E:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - E:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.8.7.2\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {f34c9277-6577-4dff-b2d7-7d58092f272f} - E:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4:64bit: - HKLM..\Run: [RtHDVBg] E:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] E:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] E:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DATAMNGR] E:\Program Files (x86)\Search Results Toolbar\Datamngr\datamngrUI.exe (Bandoo Media Inc)
O4 - HKLM..\Run: [HotkeyApp] E:\Program Files (x86)\Launch Manager\HotkeyApp.exe (Wistron)
O4 - HKLM..\Run: [LMgrOSD]  File not found
O4 - HKLM..\Run: [LMgrVolOSD] E:\Program Files (x86)\Launch Manager\OSD.exe (Wistron Corp.)
O4 - HKLM..\Run: [NUSB3MON] E:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [Wbutton] E:\Program Files (x86)\Launch Manager\Wbutton.exe (Wistron Corp.)
O4 - HKU\LocalService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_E..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_E..\RunOnce: [mctadmin]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra Button: eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9:64bit: - Extra 'Tools' menuitem : eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra Button: eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O9 - Extra 'Tools' menuitem : eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} -  File not found
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} hxxp://91.113.220.122/activex/AMC.cab (AxisMediaControlEmb Class)
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll) - E:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\datamngr.dll (Bandoo Media Inc)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll) - E:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\IEBHO.dll (Bandoo Media Inc)
O20 - AppInit_DLLs: (c:\progra~3\browse~1\251005~1.80\{c16c1~1\browse~1.dll) - E:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\Florian_ON_E Winlogon: Shell - (explorer.exe) - E:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKU\Florian_ON_E Winlogon: Shell - (C:\Users\Florian\AppData\Roaming\skype.dat) - E:\Users\Florian\AppData\Roaming\skype.dat ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{15c05717-a038-11e1-9e5c-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15c05717-a038-11e1-9e5c-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{15c05720-a038-11e1-9e5c-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15c05720-a038-11e1-9e5c-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{15ef4256-47f5-11e0-9dd5-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15ef4256-47f5-11e0-9dd5-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{15ef4265-47f5-11e0-9dd5-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15ef4265-47f5-11e0-9dd5-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{15ef4267-47f5-11e0-9dd5-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15ef4267-47f5-11e0-9dd5-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{17f17a45-50b9-11e0-aac0-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{17f17a45-50b9-11e0-aac0-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{17f17a53-50b9-11e0-aac0-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{17f17a53-50b9-11e0-aac0-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{4d9a9eba-2524-11e0-8f53-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{4d9a9eba-2524-11e0-8f53-806e6f6e6963}\Shell\AutoRun\command - "" = E:\cdstart.exe
O33 - MountPoints2\{552b7940-47f9-11e0-8eb8-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{552b7940-47f9-11e0-8eb8-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{552b7942-47f9-11e0-8eb8-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{552b7942-47f9-11e0-8eb8-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{6e7e3b9c-523d-11e0-a8ca-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{6e7e3b9c-523d-11e0-a8ca-485d60465352}\Shell\AutoRun\command - "" = H:\AutoRun.exe
O33 - MountPoints2\{79b6d9a4-b7be-11e1-91ad-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{79b6d9a4-b7be-11e1-91ad-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{84ebdeae-ddac-11e1-aa4b-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{84ebdeae-ddac-11e1-aa4b-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{962c8a44-e2da-11e0-a52c-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{962c8a44-e2da-11e0-a52c-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{983e8907-4dd5-11e2-a5c5-00262dc3534e}\Shell - "" = AutoRun
O33 - MountPoints2\{983e8907-4dd5-11e2-a5c5-00262dc3534e}\Shell\AutoRun\command - "" = E:\cdstart.exe
O33 - MountPoints2\{c04b7e29-bec5-11e1-914e-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{c04b7e29-bec5-11e1-914e-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{c04b7e2b-bec5-11e1-914e-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{c04b7e2b-bec5-11e1-914e-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{e566942f-da2c-11e0-a997-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{e566942f-da2c-11e0-a997-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{ebb4f2fe-70c4-11e0-a6ee-001e101f2500}\Shell - "" = AutoRun
O33 - MountPoints2\{ebb4f2fe-70c4-11e0-a6ee-001e101f2500}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{fdc9e9cd-dadb-11e0-a6c8-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{fdc9e9cd-dadb-11e0-a6c8-485d60465352}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[1 E:\Windows\*.tmp files -> E:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/05/11 04:40:08 | 000,067,584 | --S- | M] () -- E:\Windows\bootstat.dat
[2013/05/11 04:40:04 | 000,001,110 | ---- | M] () -- E:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/11 04:40:03 | 000,000,884 | ---- | M] () -- E:\Windows\tasks\Adobe Flash Player Updater.job
[2013/05/11 04:39:15 | 000,654,852 | ---- | M] () -- E:\Windows\System32\perfh007.dat
[2013/05/11 04:39:15 | 000,616,694 | ---- | M] () -- E:\Windows\System32\perfh009.dat
[2013/05/11 04:39:15 | 000,130,434 | ---- | M] () -- E:\Windows\System32\perfc007.dat
[2013/05/11 04:39:15 | 000,106,816 | ---- | M] () -- E:\Windows\System32\perfc009.dat
[2013/05/11 04:38:23 | 000,000,004 | ---- | M] () -- E:\Users\Florian\AppData\Roaming\skype.ini
[2013/05/11 03:31:16 | 000,001,106 | ---- | M] () -- E:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/11 03:30:21 | 3061,960,704 | -HS- | M] () -- E:\hiberfil.sys
[2013/05/06 11:38:34 | 000,010,096 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/06 11:38:34 | 000,010,096 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/05 09:10:47 | 322,613,881 | ---- | M] () -- E:\Windows\MEMORY.DMP
[2013/04/30 16:12:31 | 000,000,374 | ---- | M] () -- E:\Windows\System32\drivers\etc\hosts.ics
[1 E:\Windows\*.tmp files -> E:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/05/04 18:12:45 | 000,000,004 | ---- | C] () -- E:\Users\Florian\AppData\Roaming\skype.ini
[2012/03/16 10:07:40 | 000,102,400 | ---- | C] () -- E:\Users\Florian\AppData\Roaming\skype.dat
[2011/03/17 13:30:31 | 000,000,400 | ---- | C] () -- E:\Windows\ODBC.INI
[2011/03/16 10:25:13 | 001,527,912 | ---- | C] () -- E:\Windows\SysWow64\PerfStringBackup.INI
[2010/11/03 13:47:42 | 000,000,000 | ---- | C] () -- E:\Windows\Bench32.INI
[2010/11/02 13:04:22 | 000,127,184 | ---- | C] () -- E:\Windows\Unwise.exe
[2010/11/02 13:04:21 | 000,149,504 | ---- | C] () -- E:\Windows\unwise32_setup.exe
[2010/11/02 12:49:13 | 000,451,072 | ---- | C] () -- E:\Windows\SysWow64\ISSRemoveSP.exe
[2010/11/02 12:10:54 | 000,870,560 | ---- | C] () -- E:\Windows\SysWow64\igkrng575.bin
[2010/11/02 12:10:54 | 000,208,896 | ---- | C] () -- E:\Windows\SysWow64\iglhsip32.dll
[2010/11/02 12:10:54 | 000,143,360 | ---- | C] () -- E:\Windows\SysWow64\iglhcp32.dll
[2010/11/02 12:10:54 | 000,104,796 | ---- | C] () -- E:\Windows\SysWow64\igfcg575m.bin
[2010/11/02 12:10:52 | 000,127,868 | ---- | C] () -- E:\Windows\SysWow64\igcompkrng575.bin
[2010/06/08 09:19:24 | 000,692,224 | ---- | C] () -- E:\Windows\SysWow64\libeay32.dll
[2010/06/08 09:19:24 | 000,151,552 | ---- | C] () -- E:\Windows\SysWow64\ssleay32.dll
[2010/04/20 10:31:43 | 000,936,832 | ---- | C] () -- E:\Windows\SysWow64\M2ElevatedCalls.dll
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- E:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- E:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- E:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- E:\Windows\mib.bin
[2009/07/13 20:02:54 | 000,245,248 | ---- | C] () -- E:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- E:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- E:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- E:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- E:\Windows\SysWow64\mlang.dat
[2008/10/07 04:13:30 | 000,197,912 | ---- | C] () -- E:\Windows\SysWow64\physxcudart_20.dll
[2008/10/07 04:13:22 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSwedish.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSpanish.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelPortugese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelKorean.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelJapanese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelGerman.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelFrench.dll
[2003/02/20 12:53:42 | 000,005,702 | ---- | C] () -- E:\Windows\SysWow64\OUTLPERF.INI
 
========== LOP Check ==========
 
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Application Data
[2012/12/28 13:30:02 | 000,000,000 | ---D | M] -- E:\ProgramData\Babylon
[2012/12/02 02:34:48 | 000,000,000 | ---D | M] -- E:\ProgramData\boost_interprocess
[2012/12/28 13:30:25 | 000,000,000 | ---D | M] -- E:\ProgramData\BrowserProtect
[2011/03/17 13:17:26 | 000,000,000 | ---D | M] -- E:\ProgramData\DAEMON Tools Lite
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Documents
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favorites
[2011/03/17 13:40:24 | 000,000,000 | ---D | M] -- E:\ProgramData\mquadr.at
[2011/03/17 13:49:28 | 000,000,000 | ---D | M] -- E:\ProgramData\Partner
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Start Menu
[2010/11/06 11:48:32 | 000,000,000 | ---D | M] -- E:\ProgramData\Temp
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Templates
[2011/04/03 05:23:12 | 000,000,000 | ---D | M] -- E:\ProgramData\VirtualizedApplications
[2010/11/02 13:13:33 | 000,000,000 | ---D | M] -- E:\ProgramData\X10 Settings
[2011/09/08 11:20:06 | 000,000,000 | -H-D | M] -- E:\ProgramData\{6B3B2B58-1531-427B-BBBF-916BC14A9172}
[2013/04/11 10:10:45 | 000,032,640 | ---- | M] () -- E:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >
         
--- --- ---

Sorry hab es ausversehen 2mal gepostet!!
__________________


Alt 26.05.2013, 18:14   #18
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
laptop von der österreichischen polizei gesperrt! - Standard

laptop von der österreichischen polizei gesperrt!



Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
ATTFilter
:OTL
O20 - HKU\Florian_ON_E Winlogon: Shell - (C:\Users\Florian\AppData\Roaming\skype.dat) - E:\Users\Florian\AppData\Roaming\skype.dat ()
:Files
E:\Users\Florian\AppData\Roaming\skype.dat
E:\Users\Florian\AppData\Roaming\skype.ini
:Commands
[purity]
[resethosts]
         
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen!
2.) Ordner movedfiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten!

4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten
__________________
__________________

Alt 27.05.2013, 15:25   #19
karly
 
laptop von der österreichischen polizei gesperrt! - Standard

laptop von der österreichischen polizei gesperrt!



Wo ist die custom scan fix Box? Im OTL oder im OTLPE?

Alt 27.05.2013, 16:06   #20
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
laptop von der österreichischen polizei gesperrt! - Standard

laptop von der österreichischen polizei gesperrt!



Der Textbereich unten in OTLPE

__________________
Logfiles bitte immer in CODE-Tags posten

Alt 03.06.2013, 20:56   #21
karly
 
laptop von der österreichischen polizei gesperrt! - Standard

laptop von der österreichischen polizei gesperrt!



Danke cosinus!!!
Der Laptop funktioniert wieder seit ein paar Tage.
Danke nochmal, und viel Erfolg beim weiteren Fälle lösen

Alt 04.06.2013, 10:24   #22
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
laptop von der österreichischen polizei gesperrt! - Standard

laptop von der österreichischen polizei gesperrt!



Wir sind hier noch nicht fertig!
Du solltest das Log posten und die OTLPE-Q bei uns hochladen
__________________
Logfiles bitte immer in CODE-Tags posten

Antwort

Themen zu laptop von der österreichischen polizei gesperrt!
100 euro zahlen, angeblich, arten, bezahlen, bild, erneute, euro, gesperrt, google, googlen, handy, hoffe, interne, internet, laptop, laptop gesperrt, niemand, pay safe, plötzlich, polizei, software, starte, starten, unerfahren, verständliche, virus, weißer, ähnliches



Ähnliche Themen: laptop von der österreichischen polizei gesperrt!


  1. laptop gesperrt von Polizei
    Plagegeister aller Art und deren Bekämpfung - 05.09.2013 (5)
  2. Computer gesperrt /Trojaner-Polizei Österreich
    Log-Analyse und Auswertung - 30.08.2013 (9)
  3. laptop gesperrt von Polizei
    Mülltonne - 29.08.2013 (3)
  4. Polizei Virus Computer gesperrt!
    Plagegeister aller Art und deren Bekämpfung - 24.04.2013 (4)
  5. Ich Computer wurde gesperrt - Bundesamt für Polizei
    Plagegeister aller Art und deren Bekämpfung - 15.04.2013 (3)
  6. Rechner gesperrt - "Polizei - Ihr Computer wurde gesperrt"
    Log-Analyse und Auswertung - 12.02.2013 (5)
  7. Polizei - Ihr Computer wurde gesperrt - Österreich
    Log-Analyse und Auswertung - 05.11.2012 (18)
  8. Computer gesperrt - Österr. Polizei
    Plagegeister aller Art und deren Bekämpfung - 18.10.2012 (11)
  9. Polizei Trojaner - PC gesperrt
    Plagegeister aller Art und deren Bekämpfung - 28.09.2012 (40)
  10. Polizei Trojaner auf dem Laptop
    Log-Analyse und Auswertung - 19.09.2012 (3)
  11. Ihr Computer wurde gesperrt - Polizei Trojaner
    Plagegeister aller Art und deren Bekämpfung - 10.09.2012 (1)
  12. Österreichischen Polizeitrojaner sperrt mein Internet
    Plagegeister aller Art und deren Bekämpfung - 31.08.2012 (17)
  13. PC wurde von der österreichischen Republik geperrt -> €100 zahlen
    Plagegeister aller Art und deren Bekämpfung - 18.08.2012 (13)
  14. Ihr Computer wurde gesperrt + Polizei + Ukash
    Plagegeister aller Art und deren Bekämpfung - 11.07.2012 (1)
  15. Polizei, Computer gesperrt, zahle 100 EUR
    Plagegeister aller Art und deren Bekämpfung - 11.06.2012 (12)
  16. Laptop gesperrt durch Virus gesperrt. Zahlung von 50 Euro etc.
    Plagegeister aller Art und deren Bekämpfung - 17.12.2011 (7)
  17. Lücke im österreichischen Bezahlsystem Maestro SecureCode
    Nachrichten - 27.03.2010 (0)

Zum Thema laptop von der österreichischen polizei gesperrt! - Nicht irgendeinen Windows-Ordner, du musst den Windows-Ordner deiner Windows-Installation nehmen - steht das nicht in der Anleitung?! - laptop von der österreichischen polizei gesperrt!...
Archiv
Du betrachtest: laptop von der österreichischen polizei gesperrt! auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.