"BKA-Trojaner" auf Windows Vista - weißer Bildschirm nach dem Booten

t0bIng3r · 06.06.2013, 22:15

Guten Abend, im Vorraus schon einmal ein Danke an alle, die sich Zeit nehmen für mein Problem.

Mein Bruder hat sich leider die österreichische Version des "BKA-Trojaners" (oder wie man ihn nennen soll) eingefangen und ich habe gestern Abend mal versucht, mit den Anleitungen, die man so im Internet findet, etwas zu retten, leider hatte ich keinen Erfolg.

OS: Windows Vista Home Premium SP2 32 bit

Wenn ich den PC hochfahre, komme ich kurz zum Desktop und innerhalb von ner halben Sekunde oder so wird der Bildschirm komplett weiß und ich kann nichts machen, außer Strg+Alt+Entf. Wenn ich hier aber z.B. den Task-Manager starte, komme ich wieder zum weißen Bildschirm.

Wenn ich im abgesicherten Modus starte, schaltet sich der PC sofort wieder aus. Die einzige Möglichkeit ist der abgesicherte Modus mit Eingabeaufforderung. D.h. etwaige Dinge, die ich aus der Shell machen kann, wären möglich.

Ich habe mir jetzt mal Reatogo X-PE auf eine CD gebrannt und da rein gebootet, konnte zumindest einige Dateien sichern, aber auf viele Ordner habe ich leider keinen Zugriff.

Da ich die Schritte von http://www.trojaner-board.de/69886-a...-beachten.html nicht am PC selbst ausführen kann, habe ich sie jetzt mal unter dem Reatogo X-PE OS ausgeführt. Ich hoffe das hilft euch auch weiter..

Hier die Logfiles:

OTL.txt:

Code:

ATTFilter

OTL logfile created on: 6/6/2013 9:39:54 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Windows Vista (TM) Home Premium Service Pack 2 (Version = 6.0.6002) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = G: | %SystemRoot% = G:\Windows | %ProgramFiles% = G:\Program Files
Drive C: | 100.00 Mb Total Space | 66.34 Mb Free Space | 66.34% Space Free | Partition Type: NTFS
Drive G: | 465.66 Gb Total Space | 325.85 Gb Free Space | 69.98% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet003
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [On_Demand] --  -- (AVG Security Toolbar Service)
SRV - [2013/05/22 11:23:07 | 001,015,984 | ---- | M] (AVG Secure Search) [Auto] -- G:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\15.2.0\ToolbarUpdater.exe -- (vToolbarUpdater15.2.0)
SRV - [2013/05/18 03:55:28 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand] -- G:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/05/14 14:58:19 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- G:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/05/10 03:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto] -- G:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013/02/25 18:22:34 | 001,260,320 | ---- | M] (NVIDIA Corporation) [Auto] -- G:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2013/02/05 11:48:00 | 000,235,216 | ---- | M] (McAfee, Inc.) [On_Demand] -- G:\Program Files\McAfee Security Scan\3.0.318\McCHSvc.exe -- (McComponentHostService)
SRV - [2013/01/18 02:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto] -- G:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012/11/15 18:34:30 | 005,814,904 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- G:\Program Files\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent)
SRV - [2012/10/22 08:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- G:\Program Files\AVG\AVG2013\avgwdsvc.exe -- (avgwd)
SRV - [2012/01/23 00:43:08 | 000,092,592 | ---- | M] (TomTom) [Auto] -- G:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService)
SRV - [2009/03/31 03:39:36 | 000,233,472 | ---- | M] (Teruten) [Auto] -- G:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService)
SRV - [2008/04/07 03:17:30 | 000,430,592 | ---- | M] (Nokia.) [On_Demand] -- G:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008/01/20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto] -- G:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand] --  -- (IpInIp)
DRV - [2013/05/22 11:23:07 | 000,037,664 | ---- | M] (AVG Technologies) [Kernel | System] -- G:\Windows\System32\drivers\avgtpx86.sys -- (avgtp)
DRV - [2013/02/25 18:22:06 | 008,939,296 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- G:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2013/02/06 08:19:14 | 001,690,784 | ---- | M] (Ralink Technology, Corp.) [Kernel | On_Demand] -- G:\Windows\System32\drivers\rt2870.sys -- (rt2870)
DRV - [2012/11/15 18:33:26 | 000,094,048 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot] -- G:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2012/10/22 08:02:46 | 000,179,936 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System] -- G:\Windows\System32\drivers\avgidsdriverx.sys -- (AVGIDSDriver)
DRV - [2012/10/14 22:48:52 | 000,055,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot] -- G:\Windows\System32\drivers\avgidshx.sys -- (AVGIDSHX)
DRV - [2012/10/01 22:30:38 | 000,159,712 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- G:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2012/09/20 22:46:06 | 000,164,832 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- G:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2012/09/20 22:46:00 | 000,177,376 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot] -- G:\Windows\System32\drivers\avglogx.sys -- (Avglogx)
DRV - [2012/09/20 22:45:54 | 000,019,936 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System] -- G:\Windows\System32\drivers\avgidsshimx.sys -- (AVGIDSShim)
DRV - [2012/09/13 22:05:20 | 000,035,552 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot] -- G:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86)
DRV - [2009/10/20 13:47:56 | 000,112,640 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- G:\Windows\System32\drivers\ewusbnet.sys -- (ewusbnet)
DRV - [2009/10/12 10:22:56 | 000,101,120 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- G:\Windows\System32\drivers\ewusbdev.sys -- (hwusbdev)
DRV - [2009/09/10 09:55:58 | 000,102,912 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- G:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2009/03/31 03:39:36 | 000,036,608 | ---- | M] () [Kernel | On_Demand] -- G:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2009/03/20 04:01:26 | 000,121,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- G:\Windows\System32\drivers\ss_bmdm.sys -- (ss_bmdm)
DRV - [2009/03/20 04:01:26 | 000,090,112 | ---- | M] (MCCI) [Kernel | On_Demand] -- G:\Windows\System32\drivers\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM)
DRV - [2009/03/20 04:01:26 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- G:\Windows\System32\drivers\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter)
DRV - [2008/10/09 08:50:08 | 000,022,528 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot] -- G:\Windows\System32\drivers\BMLoad.sys -- (BMLoad)
DRV - [2008/10/09 08:50:04 | 000,018,816 | ---- | M] (Bytemobile, Inc.) [Kernel | System] -- G:\Windows\System32\drivers\tcpipBM.sys -- (tcpipBM)
DRV - [2008/01/20 22:23:25 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- G:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2007/09/17 09:53:26 | 000,021,632 | ---- | M] (Nokia) [Kernel | On_Demand] -- G:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2007/04/03 05:43:28 | 001,131,136 | ---- | M] (Philips Semiconductors GmbH) [Kernel | On_Demand] -- G:\Windows\System32\drivers\Ph3xIB32.sys -- (Ph3xIB32)
DRV - [2006/12/05 06:34:42 | 000,507,136 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand] -- G:\Windows\System32\drivers\PFC027.SYS -- (PAC207)
DRV - [2006/11/30 10:18:18 | 000,027,416 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- G:\Windows\System32\drivers\x10ufx2.sys -- (XUIF)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\xx_ON_G\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\xx_ON_G\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\xx_ON_G\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found
IE - HKU\xx_ON_G\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.facebook.com/home.php?ref=hp"
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1209
FF - prefs.js..keyword.URL: ""
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: G:\Windows\System32\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: G:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\15.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: G:\Windows\System32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: G:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: G:\Program Files\McAfee Security Scan\3.0.318\npMcAfeeMSS.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: G:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: G:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: G:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: G:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@toolbar: C:\ProgramData\AVG Secure Search\FireFoxExt\15.2.0.5 [2013/05/22 11:23:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/05/18 03:54:51 | 000,000,000 | ---D | M]
 
[2012/02/24 15:35:04 | 000,000,000 | ---D | M] (No name found) -- G:\Users\xx\AppData\Roaming\Mozilla\Extensions
[2012/02/24 15:35:04 | 000,000,000 | ---D | M] (No name found) -- G:\Users\xx\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com
[2013/05/14 14:48:16 | 000,000,000 | ---D | M] (No name found) -- G:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\ny4thmv5.default\extensions
[2011/03/24 15:34:28 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- G:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\ny4thmv5.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012/05/05 04:09:44 | 000,000,933 | ---- | M] () -- G:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\ny4thmv5.default\searchplugins\11-suche.xml
[2012/05/05 04:09:44 | 000,002,419 | ---- | M] () -- G:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\ny4thmv5.default\searchplugins\englische-ergebnisse.xml
[2013/05/14 14:48:18 | 000,010,727 | ---- | M] () -- G:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\ny4thmv5.default\searchplugins\gmx-suche-sterreich.xml
[2012/05/05 04:09:44 | 000,010,525 | ---- | M] () -- G:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\ny4thmv5.default\searchplugins\gmx-suche.xml
[2012/05/05 04:09:44 | 000,002,457 | ---- | M] () -- G:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\ny4thmv5.default\searchplugins\lastminute.xml
[2012/05/05 04:09:44 | 000,005,508 | ---- | M] () -- G:\Users\xx\AppData\Roaming\Mozilla\Firefox\Profiles\ny4thmv5.default\searchplugins\webde-suche.xml
[2013/05/18 03:55:31 | 000,000,000 | ---D | M] (No name found) -- G:\Program Files\Mozilla Firefox\browser\extensions
[2013/05/18 03:55:31 | 000,000,000 | ---D | M] (Default) -- G:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- 
[2013/05/22 11:23:41 | 000,000,000 | ---D | M] (AVG Security Toolbar) -- G:\PROGRAMDATA\AVG SECURE SEARCH\FIREFOXEXT\15.2.0.5
() (No name found) -- G:\USERS\xx\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\NY4THMV5.DEFAULT\EXTENSIONS\TOOLBAR@GMX.NET.XPI
[2013/02/21 16:46:33 | 000,003,714 | ---- | M] () -- G:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
 
O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | ---- | M]) - G:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - G:\Program Files\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - G:\Program Files\AVG Secure Search\15.2.0.5\AVG Secure Search_toolbar.dll (AVG Secure Search)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - G:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - G:\Program Files\AVG Secure Search\15.2.0.5\AVG Secure Search_toolbar.dll (AVG Secure Search)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4 - HKLM..\Run: [AVG_UI] G:\Program Files\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [DataCardMonitor] G:\Program Files\T-Mobile\T-Mobile Internet Manager\DataCardMonitor.exe (Huawei Technologies Co., Ltd.)
O4 - HKLM..\Run: [Monitor] G:\Windows\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKLM..\Run: [NPSStartup]  File not found
O4 - HKLM..\Run: [vProt] G:\Program Files\AVG Secure Search\vprot.exe (AVG Secure Search)
O4 - HKLM..\Run: [Windows Defender] G:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\xx_ON_G..\Run: [AutoStartNPSAgent] G:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKU\xx_ON_G..\Run: [HW_OPENEYE_OUC_T-Mobile Internet Manager] G:\Program Files\T-Mobile\T-Mobile Internet Manager\UpdateDog\ouc.exe (Huawei Technologies Co., Ltd.)
O4 - HKU\xx_ON_G..\Run: [TomTomHOME.exe] G:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - HKU\LocalService_ON_G..\Run: [WindowsWelcomeCenter] G:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\NetworkService_ON_G..\Run: [WindowsWelcomeCenter] G:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\UpdatusUser_ON_G..\Run: [WindowsWelcomeCenter] G:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.33.55.5 212.33.32.160
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - G:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\15.2.0\ViProtocol.dll (AVG Secure Search)
O20 - HKLM Winlogon: Shell - (explorer.exe) - G:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\xx_ON_G Winlogon: Shell - (explorer.exe) - G:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\xx_ON_G Winlogon: Shell - (C:\Users\xx\AppData\Roaming\skype.dat) - G:\Users\xx\AppData\Roaming\skype.dat ()
O24 - Desktop WallPaper: G:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: G:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - G:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{c3ec1e2b-0c6b-11e0-9402-001d9296f07d}\Shell - "" = AutoRun
O33 - MountPoints2\{c3ec1e2b-0c6b-11e0-9402-001d9296f07d}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{c3ec1e38-0c6b-11e0-9402-001e101fe5e1}\Shell - "" = AutoRun
O33 - MountPoints2\{c3ec1e38-0c6b-11e0-9402-001e101fe5e1}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O33 - MountPoints2\{e6d30445-6b71-11e0-af1a-001e101f63cf}\Shell - "" = AutoRun
O33 - MountPoints2\{e6d30445-6b71-11e0-af1a-001e101f63cf}\Shell\AutoRun\command - "" = I:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/05/18 03:54:48 | 000,000,000 | ---D | C] -- G:\Program Files\Mozilla Firefox
 
========== Files - Modified Within 30 Days ==========
 
[2013/06/05 16:10:54 | 000,067,584 | --S- | M] () -- G:\Windows\bootstat.dat
[2013/06/05 16:10:53 | 3219,312,640 | -HS- | M] () -- G:\hiberfil.sys
[2013/06/05 16:07:11 | 000,000,004 | ---- | M] () -- G:\Users\xx\AppData\Roaming\skype.ini
[2013/06/05 16:04:58 | 000,003,712 | -H-- | M] () -- G:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2013/06/05 16:04:57 | 000,003,712 | -H-- | M] () -- G:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2013/06/05 15:09:57 | 000,000,680 | ---- | M] () -- G:\Users\xx\AppData\Local\d3d9caps.dat
[2013/06/03 15:58:00 | 000,000,884 | ---- | M] () -- G:\Windows\tasks\Adobe Flash Player Updater.job
[2013/05/22 15:30:29 | 000,632,004 | ---- | M] () -- G:\Windows\System32\perfh007.dat
[2013/05/22 15:30:29 | 000,598,702 | ---- | M] () -- G:\Windows\System32\perfh009.dat
[2013/05/22 15:30:29 | 000,127,266 | ---- | M] () -- G:\Windows\System32\perfc007.dat
[2013/05/22 15:30:29 | 000,104,716 | ---- | M] () -- G:\Windows\System32\perfc009.dat
[2013/05/22 15:18:30 | 000,007,168 | ---- | M] () -- G:\Users\xx\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/05/22 11:23:43 | 000,003,714 | ---- | M] () -- G:\Program Files\Mozilla Firefoxavg-secure-search.xml
[2013/05/22 11:23:07 | 000,037,664 | ---- | M] (AVG Technologies) -- G:\Windows\System32\drivers\avgtpx86.sys
[2013/05/18 03:36:29 | 000,318,072 | ---- | M] () -- G:\Windows\System32\FNTCACHE.DAT
[2013/05/16 15:38:59 | 000,002,425 | ---- | M] () -- G:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
 
========== Files Created - No Company Name ==========
 
[2013/06/05 16:00:39 | 3219,312,640 | -HS- | C] () -- G:\hiberfil.sys
[2013/06/04 11:32:07 | 000,000,004 | ---- | C] () -- G:\Users\xx\AppData\Roaming\skype.ini
[2013/05/22 11:23:26 | 000,003,714 | ---- | C] () -- G:\Program Files\Mozilla Firefoxavg-secure-search.xml
[2013/03/06 17:16:22 | 000,007,168 | ---- | C] () -- G:\Users\xx\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013/01/15 12:49:48 | 000,014,172 | ---- | C] () -- G:\Windows\System32\RaCoInst.dat
[2012/01/26 13:43:52 | 000,059,904 | ---- | C] () -- G:\Users\xx\AppData\Roaming\skype.dat
[2011/09/14 16:34:25 | 000,110,592 | ---- | C] () -- G:\Windows\System32\FsUsbExDevice.Dll
[2011/09/14 16:34:25 | 000,036,608 | ---- | C] () -- G:\Windows\System32\FsUsbExDisk.Sys
[2010/12/29 16:54:57 | 000,117,248 | ---- | C] () -- G:\Windows\System32\EhStorAuthn.dll
[2010/12/29 16:54:57 | 000,107,612 | ---- | C] () -- G:\Windows\System32\StructuredQuerySchema.bin
[2010/12/28 12:58:48 | 000,018,904 | ---- | C] () -- G:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2010/12/06 09:47:55 | 000,000,000 | ---- | C] () -- G:\Windows\nsreg.dat
[2010/12/06 09:23:53 | 000,000,400 | ---- | C] () -- G:\Windows\ODBC.INI
[2010/12/06 09:10:15 | 000,000,680 | ---- | C] () -- G:\Users\xx\AppData\Local\d3d9caps.dat
[2008/01/21 03:15:58 | 000,632,004 | ---- | C] () -- G:\Windows\System32\perfh007.dat
[2008/01/21 03:15:58 | 000,290,748 | ---- | C] () -- G:\Windows\System32\perfi007.dat
[2008/01/21 03:15:58 | 000,127,266 | ---- | C] () -- G:\Windows\System32\perfc007.dat
[2008/01/21 03:15:58 | 000,036,916 | ---- | C] () -- G:\Windows\System32\perfd007.dat
[2007/10/25 11:26:10 | 000,005,632 | ---- | C] () -- G:\Windows\System32\drivers\StarOpen.sys
[2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- G:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 000,318,072 | ---- | C] () -- G:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- G:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,598,702 | ---- | C] () -- G:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- G:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,104,716 | ---- | C] () -- G:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- G:\Windows\System32\perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- G:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- G:\Windows\mib.bin
[2006/11/02 04:27:46 | 000,000,518 | ---- | C] () -- G:\Windows\System32\SP207.INI
[2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- G:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- G:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- G:\Windows\System32\mlang.dat
[2003/02/20 12:53:42 | 000,005,702 | ---- | C] () -- G:\Windows\System32\OUTLPERF.INI
 
========== LOP Check ==========
 
[2010/12/06 09:07:57 | 000,000,000 | -HSD | M] -- G:\ProgramData\Anwendungsdaten
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- G:\ProgramData\Application Data
[2012/11/05 15:41:02 | 000,000,000 | ---D | M] -- G:\ProgramData\AVG Secure Search
[2012/01/19 11:18:46 | 000,000,000 | ---D | M] -- G:\ProgramData\AVG Security Toolbar
[2012/11/05 15:42:05 | 000,000,000 | ---D | M] -- G:\ProgramData\AVG2013
[2011/02/20 17:20:45 | 000,000,000 | -H-D | M] -- G:\ProgramData\CanonBJ
[2010/12/06 10:04:32 | 000,000,000 | -H-D | M] -- G:\ProgramData\Common Files
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- G:\ProgramData\Desktop
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- G:\ProgramData\Documents
[2010/12/06 09:07:57 | 000,000,000 | -HSD | M] -- G:\ProgramData\Dokumente
[2010/12/06 09:07:57 | 000,000,000 | -HSD | M] -- G:\ProgramData\Favoriten
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- G:\ProgramData\Favorites
[2013/06/05 15:10:05 | 000,000,000 | ---D | M] -- G:\ProgramData\MFAData
[2011/09/14 16:37:33 | 000,000,000 | ---D | M] -- G:\ProgramData\PC Suite
[2012/12/03 16:27:27 | 000,000,000 | ---D | M] -- G:\ProgramData\Soulseek
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- G:\ProgramData\Start Menu
[2010/12/06 09:07:57 | 000,000,000 | -HSD | M] -- G:\ProgramData\Startmenü
[2006/11/02 09:02:04 | 000,000,000 | -HSD | M] -- G:\ProgramData\Templates
[2012/02/24 15:35:14 | 000,000,000 | ---D | M] -- G:\ProgramData\TomTom
[2010/12/06 09:07:58 | 000,000,000 | -HSD | M] -- G:\ProgramData\Vorlagen
[2013/06/05 16:07:21 | 000,032,510 | ---- | M] () -- G:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >

Gmer konnte ich leider nicht ausführen, habe immer folgenden Fehler bekommen:
"X:\i386\system32\config\system: The system cannot find the file specified."

Ich hoffe ihr könnt mir Tipps geben wie ich weiter vorgehen soll..

Danke schon mal im Vorraus.

VG t0bIng3r

PS: Ich bin ganz fit am PC, d.h. ihr müsst euch nicht die Mühe machen und Schritte wie z.B. notepad öffen (ein Beispiel, das ich irgendwo im Forum schon gesehen habe) beschreiben.

"BKA-Trojaner" auf Windows Vista - weißer Bildschirm nach dem Booten

Plagegeister aller Art und deren Bekämpfung: "BKA-Trojaner" auf Windows Vista - weißer Bildschirm nach dem Booten

"BKA-Trojaner" auf Windows Vista - weißer Bildschirm nach dem Booten

Ähnliche Themen: "BKA-Trojaner" auf Windows Vista - weißer Bildschirm nach dem Booten