Trojaner-Board - Log File Analyse, was tun ?

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Log File Analyse, was tun ? (https://www.trojaner-board.de/104008-log-file-analyse-tun.html)

Log File Analyse, was tun ?

Hallo Leute,
Ich bin auf einen mir neuartigen "Virus" gestoßen und weiß nicht mehr weiter.
Ich bin einer Anleitung gefolgt und habe diesen Log File bekommen, den man hier posten sollte.
Ich hoffe ihr könnt mir weiterhelfen, wäre super.

Zitat:

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:c:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\jashla.exe deleted successfully.
File C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\jashla.exe not found.
========== FILES ==========
File\Folder C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\jashla.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: ACHIM-ULRIKE

User: Administrator
->Flash cache emptied: 348 bytes

User: All Users

User: Christopher
->Flash cache emptied: 50793 bytes

User: Default User
->Flash cache emptied: 41 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb

[EMPTYTEMP]

User: ACHIM-ULRIKE

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 2852626 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Christopher
->Temp folder emptied: 161741358 bytes
->Temporary Internet Files folder emptied: 234150 bytes
->Java cache emptied: 602476 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33728 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 130526 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 204255048 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1119608 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 24192 bytes
Windows Temp folder emptied: 10959690 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 364,00 mb

OTL by OldTimer - Version 3.2.29.1 log created on 10092011_215721

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Ich korrigiere mich mal, ich denke hiermit kann man mehr anfangen ??
Sry habe dieses Programm noch nie benutzt.
OTL Logfile:

Code:

OTL logfile created on: 09.10.2011 22:21:31 - Run 2

OTL by OldTimer - Version 3.2.29.1     Folder = F:\

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,48 Mb Total Physical Memory | 374,39 Mb Available Physical Memory | 73,20% Memory free

1,22 Gb Paging File | 1,16 Gb Available in Paging File | 94,96% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 58,59 Gb Total Space | 28,54 Gb Free Space | 48,71% Space Free | Partition Type: NTFS

Drive D: | 53,19 Gb Total Space | 53,08 Gb Free Space | 99,80% Space Free | Partition Type: NTFS

Drive F: | 980,48 Mb Total Space | 333,75 Mb Free Space | 34,04% Space Free | Partition Type: FAT

 

Computer Name: FAMILIE | User Name: Christopher | Logged in as Administrator.

Boot Mode: SafeMode | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.10.09 21:34:20 | 000,582,656 | ---- | M] (OldTimer Tools) -- F:\OTL.exe

PRC - [2004.08.04 00:57:54 | 001,035,264 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2002.08.29 14:00:00 | 000,015,360 | -H-- | M] () -- C:\WINDOWS\system32\tsd32.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Auto | Stopped] --  -- (Sound Service)

SRV - [2010.11.04 16:41:46 | 000,009,728 | -H-- | M] (Deutsche Telekom AG) [Auto | Stopped] -- C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe -- (Netzmanager Service)

SRV - [2010.10.16 01:40:40 | 000,037,664 | -H-- | M] (Apple Inc.) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)

SRV - [2010.03.18 12:19:26 | 000,113,152 | -H-- | M] (ArcSoft Inc.) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)

SRV - [2009.07.08 12:31:36 | 000,313,840 | -H-- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe -- (RoxLiveShare9)

SRV - [2009.07.08 12:31:32 | 000,170,480 | -H-- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe -- (RoxWatch9)

SRV - [2009.07.08 12:31:12 | 001,108,464 | -H-- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe -- (RoxMediaDB9)

SRV - [2007.08.09 09:27:52 | 000,073,728 | -H-- | M] (HP) [Auto | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)

SRV - [2005.04.06 17:03:28 | 000,110,592 | -H-- | M] () [Auto | Stopped] -- C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service)

SRV - [2004.10.22 03:24:18 | 000,073,728 | -H-- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2010.09.16 17:02:33 | 000,035,040 | -H-- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys -- (TelekomNM3)

DRV - [2009.12.01 23:17:42 | 000,579,712 | -H-- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emBDA.sys -- (USB28xxBGA)

DRV - [2009.12.01 23:17:06 | 000,543,744 | -H-- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emOEM.sys -- (USB28xxOEM)

DRV - [2008.03.06 22:14:06 | 000,097,792 | -H-- | M] (Protect Software GmbH) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\ACEDRV05.sys -- (ACEDRV05)

DRV - [2007.02.28 16:16:27 | 000,033,952 | -H-- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\oreans32.sys -- (oreans32)

DRV - [2007.02.26 11:45:11 | 000,022,768 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbsermpt.sys -- (usbsermpt)

DRV - [2006.04.12 15:43:50 | 000,169,472 | -H-- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8187.sys -- (RTLWUSB)

DRV - [2005.10.23 18:25:12 | 000,023,000 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btcusb.sys -- (Btcsrusb)

DRV - [2005.10.23 18:21:42 | 000,010,068 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BtNetDrv.sys -- (BT)

DRV - [2005.08.31 11:34:52 | 000,020,480 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BlueletSCOAudio.sys -- (BlueletSCOAudio)

DRV - [2005.08.31 11:34:10 | 000,020,480 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\blueletaudio.sys -- (BlueletAudio)

DRV - [2005.07.29 17:21:32 | 000,011,988 | -H-- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vbtenum.sys -- (BTHidEnum)

DRV - [2005.04.30 15:50:10 | 000,028,271 | -H-- | M] (IVT Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys -- (BTHidMgr)

DRV - [2005.03.25 18:18:48 | 000,082,148 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VcommMgr.sys -- (VcommMgr)

DRV - [2004.12.16 17:32:54 | 000,013,304 | -H-- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BTNetFilter.sys -- (BTNetFilter)

DRV - [2004.12.11 22:28:20 | 000,371,584 | RH-- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)

DRV - [2004.10.19 14:37:38 | 000,061,312 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VComm.sys -- (VComm)

DRV - [2004.08.03 23:10:14 | 000,015,360 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)

DRV - [2003.01.10 10:34:32 | 000,695,852 | RH-- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)

DRV - [2002.07.24 04:30:00 | 000,032,128 | -H-- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\viaagp1.sys -- (viaagp1)

DRV - [2001.08.17 14:53:32 | 000,003,328 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qv2kux.sys -- (QV2KUX)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 
 ========== FireFox ==========

 

FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:2.9.3.1

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\System32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: C:\Programme\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll (Google)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2536: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2594: C:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1698: C:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found

FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Programme\Gemeinsame Dateien\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.09.08 20:23:42 | 000,000,000 | -H-D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.08.18 10:51:06 | 000,000,000 | -H-D | M]

 

[2008.10.14 21:10:49 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\Christopher\Anwendungsdaten\Mozilla\Extensions

[2011.08.26 15:03:29 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\Christopher\Anwendungsdaten\Mozilla\Firefox\Profiles\ny5gubd5.default\extensions

[2011.08.26 15:03:29 | 000,000,000 | -H-D | M] (Garmin Communicator) -- C:\Dokumente und Einstellungen\Christopher\Anwendungsdaten\Mozilla\Firefox\Profiles\ny5gubd5.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

[2011.07.30 20:41:00 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Christopher\Anwendungsdaten\Mozilla\Firefox\Profiles\ny5gubd5.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2007.03.21 22:59:55 | 000,000,000 | -H-D | M] (Google Toolbar for Firefox) -- C:\Dokumente und Einstellungen\Christopher\Anwendungsdaten\Mozilla\Firefox\Profiles\ny5gubd5.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

[2007.09.27 21:56:56 | 000,000,000 | -H-D | M] ("VideoDownloader") -- C:\Dokumente und Einstellungen\Christopher\Anwendungsdaten\Mozilla\Firefox\Profiles\ny5gubd5.default\extensions\videodowloader@videodownloader.net

[2011.08.18 10:51:08 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2007.06.05 15:53:04 | 000,000,000 | -H-D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

[2011.08.08 11:15:02 | 000,000,000 | -H-D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

[2011.08.08 11:14:35 | 000,000,000 | -H-D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF

[2011.09.08 20:23:42 | 000,134,104 | -H-- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll

[2011.08.08 11:14:35 | 000,476,904 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll

[2006.07.31 16:07:16 | 000,098,304 | -H-- | M] (Zylom) -- C:\Programme\mozilla firefox\plugins\npzylomgamesplayer.dll

[2011.08.12 06:19:37 | 000,001,392 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.08.12 06:14:12 | 000,002,252 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml

[2011.08.12 06:19:37 | 000,001,153 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml

[2011.08.12 06:19:37 | 000,006,805 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.08.12 06:19:37 | 000,001,178 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.08.12 06:19:37 | 000,001,105 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2007.03.02 14:46:58 | 000,004,188 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: 127.0.0.1 bin.errorprotector.com ## added by CiD

O1 - Hosts: 127.0.0.1 br.errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 br.winantivirus.com ## added by CiD

O1 - Hosts: 127.0.0.1 br.winfixer.com ## added by CiD

O1 - Hosts: 127.0.0.1 cdn.drivecleaner.com ## added by CiD

O1 - Hosts: 127.0.0.1 cdn.errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 cdn.winsoftware.com ## added by CiD

O1 - Hosts: 127.0.0.1 de.errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 de.winantivirus.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.cdn.drivecleaner.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.cdn.errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.cdn.winsoftware.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.systemdoctor.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.winantispyware.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.windrivecleaner.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.winfixer.com ## added by CiD

O1 - Hosts: 127.0.0.1 drivecleaner.com ## added by CiD

O1 - Hosts: 127.0.0.1 dynamique.drivecleaner.com ## added by CiD

O1 - Hosts: 127.0.0.1 errorprotector.com ## added by CiD

O1 - Hosts: 127.0.0.1 errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 es.winantivirus.com ## added by CiD

O1 - Hosts: 127.0.0.1 fr.winantivirus.com ## added by CiD

O1 - Hosts: 127.0.0.1 fr.winfixer.com ## added by CiD

O1 - Hosts: 46 more lines...

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)

O4 - HKLM..\Run: [BlackBerryAutoUpdate] C:\Programme\Gemeinsame Dateien\Research In Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()

O4 - HKLM..\Run: [RoxWatchTray] C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)

O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [TCMMouse ] C:\Programme\TCM Mouse\MouseDrv.exe ()

O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKCU..\Run: [ISUSPM] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)

O4 - HKCU..\Run: [nXBPpaqQtFIXr.exe] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\nXBPpaqQtFIXr.exe ()

O4 - Startup: C:\Dokumente und Einstellungen\Christopher\Startmenü\Programme\Autostart\Netzmanager.lnk = C:\Programme\Netzmanager\netzmanager.exe (Deutsche Telekom AG)

O4 - Startup: C:\Dokumente und Einstellungen\Christopher\Startmenü\Programme\Autostart\Picture Motion Browser Medien-Prüfung.lnk = C:\Programme\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe (Sony Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: isamonitor.exe = C:\Programme\VidCodecs\isamonitor.exe

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Recovery present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQ\ICQLite\ICQLite.exe (ICQ Ltd.)

O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQ\ICQLite\ICQLite.exe (ICQ Ltd.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O15 - HKCU\..Trusted Domains:   ([]msn in Arbeitsplatz)

O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)

O15 - HKCU\..Trusted Ranges: Range77 ([*] in Lokales Intranet)

O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)

O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab (Reg Error: Key error.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab (Java Plug-in 1.5.0_08)

O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab (Java Plug-in 1.5.0_10)

O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Java Plug-in 1.5.0_11)

O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)

O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)

O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)

O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0F2A02E8-227A-4A3C-BD3B-40686C7A1E0D}: DhcpNameServer = 192.168.2.1 192.168.2.1

O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home

O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Christopher\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Christopher\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.10.11 15:09:52 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O33 - MountPoints2\{9d6701ab-5113-11df-afba-001583b8c2ec}\Shell\AutoRun\command - "" = G:\

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.10.09 22:09:09 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Christopher\Recent

[2011.10.09 21:57:21 | 000,000,000 | -H-D | C] -- C:\_OTL

[2011.10.09 21:10:28 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Christopher\Startmenü\Programme\Data Restore

[2011.09.23 13:52:29 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Christopher\Dominik 30

[2007.08.05 21:25:09 | 018,808,272 | -H-- | C] (Macrovision Corporation) -- C:\Programme\ElsterFormular2006-Setup.exe

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.10.09 22:19:49 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011.10.09 22:11:01 | 000,001,090 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2011.10.09 21:59:02 | 000,001,014 | -H-- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job

[2011.10.09 21:58:56 | 000,001,086 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2011.10.09 21:12:06 | 000,000,304 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~6DSS92c31Apgjk

[2011.10.09 21:12:06 | 000,000,208 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~6DSS92c31Apgjkr

[2011.10.09 21:10:28 | 000,000,845 | -H-- | M] () -- C:\Dokumente und Einstellungen\Christopher\Desktop\Data Restore.lnk

[2011.10.09 21:10:23 | 000,000,328 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\6DSS92c31Apgjk

[2011.10.09 21:10:18 | 000,451,072 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\6DSS92c31Apgjk.exe

[2011.10.09 21:09:45 | 000,088,556 | -H-- | M] () -- C:\WINDOWS\System32\nvapps.xml

[2011.10.09 21:03:21 | 000,518,144 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\nXBPpaqQtFIXr.exe

[2011.10.08 19:40:39 | 000,002,422 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2011.09.17 19:33:12 | 000,000,480 | -H-- | M] () -- C:\Dokumente und Einstellungen\Achim-Ulrike\Eigene Dateien\spider.sav

 
 ========== Files Created - No Company Name ==========

 

[2011.10.09 21:12:06 | 000,000,304 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~6DSS92c31Apgjk

[2011.10.09 21:12:06 | 000,000,208 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~6DSS92c31Apgjkr

[2011.10.09 21:10:28 | 000,000,845 | -H-- | C] () -- C:\Dokumente und Einstellungen\Christopher\Desktop\Data Restore.lnk

[2011.10.09 21:10:23 | 000,000,328 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\6DSS92c31Apgjk

[2011.10.09 21:10:18 | 000,451,072 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\6DSS92c31Apgjk.exe

[2011.10.09 21:03:25 | 000,518,144 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\nXBPpaqQtFIXr.exe

[2011.08.13 18:29:01 | 000,150,566 | -H-- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-1343024091-492894223-839522115-1003-0.dat

[2011.08.13 14:59:26 | 000,150,566 | -H-- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat

[2011.03.13 22:59:58 | 000,101,608 | -H-- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat

[2010.10.29 21:09:08 | 000,032,184 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat

[2010.03.28 20:32:39 | 000,000,256 | -H-- | C] () -- C:\WINDOWS\System32\pool.bin

[2009.02.20 14:21:54 | 000,000,227 | -H-- | C] () -- C:\WINDOWS\HP_CounterReport_Update_HPSU.ini

[2009.02.20 14:21:43 | 000,000,214 | -H-- | C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini

[2009.02.20 14:16:40 | 000,000,221 | -H-- | C] () -- C:\WINDOWS\HP_RedboxHprblog_HPSU.ini

[2008.11.11 22:32:10 | 000,165,376 | -H-- | C] () -- C:\WINDOWS\System32\UNWISE.EXE

[2008.11.11 22:32:10 | 000,006,836 | -H-- | C] () -- C:\WINDOWS\System32\UNWISE.INI

[2008.11.02 16:13:00 | 000,000,050 | -H-- | C] () -- C:\WINDOWS\cdplayer.ini

[2008.03.06 22:00:08 | 000,016,081 | -H-- | C] () -- C:\WINDOWS\German.ini

[2008.03.01 22:38:09 | 002,196,824 | -H-- | C] () -- C:\Programme\O2CSetup.exe

[2007.09.02 13:01:03 | 000,000,221 | -H-- | C] () -- C:\WINDOWS\NCLogConfig.ini

[2007.08.05 21:34:11 | 000,003,202 | -H-- | C] () -- C:\WINDOWS\tm.ini

[2007.07.17 22:43:28 | 000,113,604 | -H-- | C] () -- C:\WINDOWS\hpoins07.dat

[2007.07.17 22:43:28 | 000,021,124 | -H-- | C] () -- C:\WINDOWS\hpomdl07.dat

[2007.07.06 20:19:43 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\wltrysvc.exe

[2007.07.06 20:19:43 | 000,003,078 | -H-- | C] () -- C:\WINDOWS\System32\bcmwlhom.ini

[2007.07.06 20:19:42 | 000,595,968 | -H-- | C] () -- C:\WINDOWS\System32\WatchPower.exe

[2007.07.06 20:19:42 | 000,192,512 | -H-- | C] () -- C:\WINDOWS\System32\AegisI5.exe

[2007.07.06 20:19:42 | 000,114,688 | -H-- | C] () -- C:\WINDOWS\System32\AegisI2.exe

[2007.07.06 20:19:42 | 000,024,576 | -H-- | C] () -- C:\WINDOWS\System32\PowerOff.exe

[2007.06.21 15:51:09 | 000,000,318 | -H-- | C] () -- C:\WINDOWS\WpePro_0delay.INI

[2007.04.30 19:25:33 | 000,000,716 | -H-- | C] () -- C:\WINDOWS\mozver.dat

[2007.02.28 16:21:23 | 000,001,778 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache

[2007.02.28 16:16:28 | 000,051,733 | -H-- | C] () -- C:\WINDOWS\System32\plugin1.dat

[2007.02.28 16:16:27 | 000,033,952 | -H-- | C] () -- C:\WINDOWS\System32\drivers\oreans32.sys

[2007.02.10 22:02:38 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\nsreg.dat

[2006.11.11 18:01:26 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\IFinst27.exe

[2006.11.09 13:26:28 | 000,363,520 | -H-- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2006.11.06 18:25:43 | 000,106,496 | -H-- | C] () -- C:\WINDOWS\System32\sacskza.dll

[2006.10.22 14:33:03 | 000,000,400 | -H-- | C] () -- C:\WINDOWS\ODBC.INI

[2006.10.22 12:22:00 | 001,662,976 | -H-- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2006.10.22 12:22:00 | 001,622,016 | -H-- | C] () -- C:\WINDOWS\System32\nwiz.exe

[2006.10.22 12:22:00 | 001,470,464 | -H-- | C] () -- C:\WINDOWS\System32\nview.dll

[2006.10.22 12:22:00 | 001,339,392 | -H-- | C] () -- C:\WINDOWS\System32\nvdspsch.exe

[2006.10.22 12:22:00 | 001,019,904 | -H-- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2006.10.22 12:22:00 | 000,581,632 | -H-- | C] () -- C:\WINDOWS\System32\nvhwvid.dll

[2006.10.22 12:22:00 | 000,466,944 | -H-- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2006.10.22 12:22:00 | 000,442,368 | -H-- | C] () -- C:\WINDOWS\System32\nvappbar.exe

[2006.10.22 12:22:00 | 000,425,984 | -H-- | C] () -- C:\WINDOWS\System32\keystone.exe

[2006.10.22 12:22:00 | 000,286,720 | -H-- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll

[2006.10.22 12:22:00 | 000,212,992 | -H-- | C] () -- C:\WINDOWS\System32\nvapi.dll

[2006.10.18 19:12:54 | 000,056,832 | -H-- | C] () -- C:\Dokumente und Einstellungen\Christopher\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2006.10.15 22:00:41 | 000,006,550 | -H-- | C] () -- C:\WINDOWS\jautoexp.dat

[2006.10.11 15:43:01 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI

[2006.10.11 15:41:55 | 000,177,056 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2006.10.11 15:12:06 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2006.10.11 15:07:03 | 000,021,740 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2006.07.27 19:28:42 | 003,596,288 | -H-- | C] () -- C:\WINDOWS\System32\qt-dx331.dll

[2006.07.12 01:40:17 | 000,520,192 | -H-- | C] () -- C:\WINDOWS\System32\DivXsm.exe

[2006.07.12 00:33:49 | 000,012,288 | -H-- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll

[2005.07.29 17:21:32 | 000,011,988 | -H-- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys

[2004.12.16 17:32:54 | 000,013,304 | -H-- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys

[2004.08.02 14:20:40 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat

[2002.08.29 14:00:00 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin

[2002.08.29 14:00:00 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat

[2002.08.29 14:00:00 | 000,492,072 | -H-- | C] () -- C:\WINDOWS\System32\perfh007.dat

[2002.08.29 14:00:00 | 000,472,368 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2002.08.29 14:00:00 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2002.08.29 14:00:00 | 000,269,480 | -H-- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2002.08.29 14:00:00 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat

[2002.08.29 14:00:00 | 000,090,330 | -H-- | C] () -- C:\WINDOWS\System32\perfc007.dat

[2002.08.29 14:00:00 | 000,075,462 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2002.08.29 14:00:00 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin

[2002.08.29 14:00:00 | 000,034,478 | -H-- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2002.08.29 14:00:00 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2002.08.29 14:00:00 | 000,027,440 | -H-- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys

[2002.08.29 14:00:00 | 000,004,461 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat

[2002.08.29 14:00:00 | 000,001,788 | -H-- | C] () -- C:\WINDOWS\System32\dcache.bin

[2002.08.29 14:00:00 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat

[2001.07.06 15:30:00 | 000,003,254 | -H-- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI

 
 ========== LOP Check ==========

 

[2010.02.28 20:06:09 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Bluetooth

[2010.07.03 15:11:37 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\ElsterFormular

[2010.04.11 14:25:38 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GameHouse

[2011.07.24 14:44:48 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LPLUS

[2011.05.26 22:20:33 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Netzmanager

[2010.03.28 20:29:17 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Research In Motion

[2008.08.28 17:06:53 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zylom

[2010.10.29 21:04:04 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

[2011.03.08 21:00:11 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D8116CA6-DBDF-4415-AB4A-BE0CEFB71935}

[2007.04.02 15:47:12 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Christopher\Anwendungsdaten\Command & Conquer 3 Tiberium Wars

[2008.12.23 20:52:34 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Christopher\Anwendungsdaten\Design Science

[2010.07.03 15:12:36 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Christopher\Anwendungsdaten\elsterformular

[2011.08.13 14:43:33 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Christopher\Anwendungsdaten\GARMIN

[2008.02.03 21:09:47 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Christopher\Anwendungsdaten\ICQLite

[2010.02.28 19:29:20 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Christopher\Anwendungsdaten\Image Zone Express

[2007.07.08 22:00:59 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Christopher\Anwendungsdaten\LimeWire

[2007.02.13 17:31:28 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Christopher\Anwendungsdaten\NetPumper

[2007.02.25 17:45:15 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Christopher\Anwendungsdaten\phonostar-Player

[2010.03.28 20:32:35 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\Christopher\Anwendungsdaten\Research In Motion

 
 ========== Purity Check ==========

 

 

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 76 bytes -> C:\Dokumente und Einstellungen\Achim-Ulrike\Eigene Dateien\Schöner wohnen Gartenplanung.doc:Roxio EMC Stream

@Alternate Data Stream - 76 bytes -> C:\Dokumente und Einstellungen\Achim-Ulrike\Eigene Dateien\hilbk.pdf:Roxio EMC Stream

@Alternate Data Stream - 76 bytes -> C:\Dokumente und Einstellungen\Achim-Ulrike\Eigene Dateien\FH Dortmund.doc:Roxio EMC Stream

@Alternate Data Stream - 76 bytes -> C:\Dokumente und Einstellungen\Achim-Ulrike\Eigene Dateien\Blitzlicht_09-2008.pdf:Roxio EMC Stream

@Alternate Data Stream - 76 bytes -> C:\Dokumente und Einstellungen\Achim-Ulrike\Eigene Dateien\anlagen.doc:Roxio EMC Stream

@Alternate Data Stream - 76 bytes -> C:\Dokumente und Einstellungen\Achim-Ulrike\Eigene Dateien\Anlagen Chrissi.doc:Roxio EMC Stream

@Alternate Data Stream - 76 bytes -> C:\Dokumente und Einstellungen\Achim-Ulrike\Eigene Dateien\8082-V-Hilbk.pdf:Roxio EMC Stream

 

< End of report >

--- --- ---

Edit: http://www.trojaner-board.de/103930-...te-failed.html

dort ist exakt das selbe Problem wie bei mir geschildet. Habe auf dem Rechner auch Xp installiert und die Symptome sind die selben!
Den Hinweis habe ich auch befolgt, wie ihr am ersten Logfile erkennt. Dennoch kein Unterschied.

Zitat:

Sry habe dieses Programm noch nie benutzt.

Dann solltest du auch nicht einfach wild irgendwelche Fixscripte ausprobieren, die für ganz andere Rechner bestimmt sind!
Poste das OTL-Log vom ersten Durchgang falls noch vorhanden.

Der erste Scan den ich durchgeführt habe, steht doch direkt darunter. Habe ich direkt nach dem fix gepostet.

Zitat:

Der erste Scan den ich durchgeführt habe, steht doch direkt darunter. Habe ich direkt nach dem fix gepostet.

Wenn es der erste Scan gewesen wäre, dürfte da kein Run 2 in der ersten Zeile stehen. Aber wie auch immer. :pfeiff:

Zitat:

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)

Wieso kein SP3 und IE? Ein XP auf Basis SP2 und IE6 ist sehr wackelig...Solche Update darf man nicht vernachlässigen! Mehr dazu aber später.

Funktioniert nur der abgesicherte Modus auf diesem Rechner?

Stimmt das war der 2te als quick scan sry. Den ersten habe ich nicht mehr.
Und ich muss dazu sagen, dass ist nicht mein Rechner. Ich bin mir bewusst, dass das nicht so optimal ist was da drauf ist.

Auf dem Rechner funktioniert jetzt noch nichtmal mehr Abgesicherte modus. Es werden gar keine Dateien mehr auf dem Rechner angezeigt.
Aber im abgesicherten Modus lässt er sich wenigstens noch ohne die ganzen Meldungen starten !

Zitat:

Auf dem Rechner funktioniert jetzt noch nichtmal mehr Abgesicherte modus. Es werden gar keine Dateien mehr auf dem Rechner angezeigt.
Aber im abgesicherten Modus lässt er sich wenigstens noch ohne die ganzen Meldungen starten !

Was denn jetzt? Entweder funktioniert der abgesicherte Modus oder nicht. Wie kann er nicht funktionieren wenn sich alle Programme noch starten lassen (??)

Falls du OTL im abgesicherten Modus starten kannst, dann mach einen CustomScan:

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die http://billy-oneal.com/Canned%20Spee.../customFix.png Textbox von OTL - wenn OTL auf deutsch ist wird sie mit http://larusso.trojaner-board.de/Images/otlfix.jpg beschriftet

Code:

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%ALLUSERSPROFILE%\Application Data\*.

%ALLUSERSPROFILE%\Application Data\*.exe /s

%APPDATA%\*.

%APPDATA%\*.exe /s

%SYSTEMDRIVE%\*.exe

/md5start

wininit.exe

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Klick auf http://billy-oneal.com/Canned%20Spee.../OTL/btnOK.png.
Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Der Rechner lässt sich im agesicherten Modus starten, allerdings zeigt er keine Dateien mehr auf den Festplatten an. Hier mal die Datei die mir ausgegeben wurde.
OTL Logfile:

Code:

OTL logfile created on: 09.10.2011 21:48:47 - Run 1

OTL by OldTimer - Version 3.2.29.1     Folder = C:\Dokumente und Einstellungen\Administrator\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,48 Mb Total Physical Memory | 383,82 Mb Available Physical Memory | 75,04% Memory free

1,22 Gb Paging File | 1,16 Gb Available in Paging File | 95,35% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 58,59 Gb Total Space | 28,19 Gb Free Space | 48,11% Space Free | Partition Type: NTFS

Drive D: | 53,19 Gb Total Space | 53,08 Gb Free Space | 99,80% Space Free | Partition Type: NTFS

Drive F: | 980,48 Mb Total Space | 333,77 Mb Free Space | 34,04% Space Free | Partition Type: FAT

 

Computer Name: FAMILIE | User Name: Administrator | Logged in as Administrator.

Boot Mode: SafeMode | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.10.09 21:34:20 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe

PRC - [2004.08.04 00:57:54 | 001,035,264 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2006.09.16 22:19:36 | 000,126,976 | -H-- | M] () -- C:\Programme\WinRAR\RarExt.dll

MOD - [2002.08.29 14:00:00 | 000,015,360 | -H-- | M] () -- C:\WINDOWS\system32\tsd32.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Auto | Stopped] --  -- (Sound Service)

SRV - [2010.11.04 16:41:46 | 000,009,728 | -H-- | M] (Deutsche Telekom AG) [Auto | Stopped] -- C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe -- (Netzmanager Service)

SRV - [2010.10.16 01:40:40 | 000,037,664 | -H-- | M] (Apple Inc.) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)

SRV - [2010.03.18 12:19:26 | 000,113,152 | -H-- | M] (ArcSoft Inc.) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)

SRV - [2009.07.08 12:31:36 | 000,313,840 | -H-- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe -- (RoxLiveShare9)

SRV - [2009.07.08 12:31:32 | 000,170,480 | -H-- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe -- (RoxWatch9)

SRV - [2009.07.08 12:31:12 | 001,108,464 | -H-- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe -- (RoxMediaDB9)

SRV - [2007.08.09 09:27:52 | 000,073,728 | -H-- | M] (HP) [Auto | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)

SRV - [2005.04.06 17:03:28 | 000,110,592 | -H-- | M] () [Auto | Stopped] -- C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service)

SRV - [2004.10.22 03:24:18 | 000,073,728 | -H-- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2010.09.16 17:02:33 | 000,035,040 | -H-- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys -- (TelekomNM3)

DRV - [2009.12.01 23:17:42 | 000,579,712 | -H-- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emBDA.sys -- (USB28xxBGA)

DRV - [2009.12.01 23:17:06 | 000,543,744 | -H-- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emOEM.sys -- (USB28xxOEM)

DRV - [2008.03.06 22:14:06 | 000,097,792 | -H-- | M] (Protect Software GmbH) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\ACEDRV05.sys -- (ACEDRV05)

DRV - [2007.02.28 16:16:27 | 000,033,952 | -H-- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\oreans32.sys -- (oreans32)

DRV - [2007.02.26 11:45:11 | 000,022,768 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbsermpt.sys -- (usbsermpt)

DRV - [2006.04.12 15:43:50 | 000,169,472 | -H-- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8187.sys -- (RTLWUSB)

DRV - [2005.10.23 18:25:12 | 000,023,000 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btcusb.sys -- (Btcsrusb)

DRV - [2005.10.23 18:21:42 | 000,010,068 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BtNetDrv.sys -- (BT)

DRV - [2005.08.31 11:34:52 | 000,020,480 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BlueletSCOAudio.sys -- (BlueletSCOAudio)

DRV - [2005.08.31 11:34:10 | 000,020,480 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\blueletaudio.sys -- (BlueletAudio)

DRV - [2005.07.29 17:21:32 | 000,011,988 | -H-- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vbtenum.sys -- (BTHidEnum)

DRV - [2005.04.30 15:50:10 | 000,028,271 | -H-- | M] (IVT Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys -- (BTHidMgr)

DRV - [2005.03.25 18:18:48 | 000,082,148 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VcommMgr.sys -- (VcommMgr)

DRV - [2004.12.16 17:32:54 | 000,013,304 | -H-- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BTNetFilter.sys -- (BTNetFilter)

DRV - [2004.12.11 22:28:20 | 000,371,584 | RH-- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)

DRV - [2004.10.19 14:37:38 | 000,061,312 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VComm.sys -- (VComm)

DRV - [2004.08.03 23:10:14 | 000,015,360 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)

DRV - [2003.01.10 10:34:32 | 000,695,852 | RH-- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)

DRV - [2002.07.24 04:30:00 | 000,032,128 | -H-- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\viaagp1.sys -- (viaagp1)

DRV - [2001.08.17 14:53:32 | 000,003,328 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qv2kux.sys -- (QV2KUX)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\System32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: C:\Programme\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll (Google)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2536: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2594: C:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1698: C:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found

FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Programme\Gemeinsame Dateien\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.09.08 20:23:42 | 000,000,000 | -H-D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.08.18 10:51:06 | 000,000,000 | -H-D | M]

 

[2011.08.18 10:51:08 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2007.06.05 15:53:04 | 000,000,000 | -H-D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

[2011.08.08 11:15:02 | 000,000,000 | -H-D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

[2011.09.08 20:23:42 | 000,134,104 | -H-- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll

[2011.08.08 11:14:35 | 000,476,904 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll

[2006.07.31 16:07:16 | 000,098,304 | -H-- | M] (Zylom) -- C:\Programme\mozilla firefox\plugins\npzylomgamesplayer.dll

[2011.08.12 06:19:37 | 000,001,392 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.08.12 06:14:12 | 000,002,252 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml

[2011.08.12 06:19:37 | 000,001,153 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml

[2011.08.12 06:19:37 | 000,006,805 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.08.12 06:19:37 | 000,001,178 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.08.12 06:19:37 | 000,001,105 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2007.03.02 14:46:58 | 000,004,188 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: 127.0.0.1 bin.errorprotector.com ## added by CiD

O1 - Hosts: 127.0.0.1 br.errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 br.winantivirus.com ## added by CiD

O1 - Hosts: 127.0.0.1 br.winfixer.com ## added by CiD

O1 - Hosts: 127.0.0.1 cdn.drivecleaner.com ## added by CiD

O1 - Hosts: 127.0.0.1 cdn.errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 cdn.winsoftware.com ## added by CiD

O1 - Hosts: 127.0.0.1 de.errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 de.winantivirus.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.cdn.drivecleaner.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.cdn.errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.cdn.winsoftware.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.systemdoctor.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.winantispyware.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.windrivecleaner.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.winfixer.com ## added by CiD

O1 - Hosts: 127.0.0.1 drivecleaner.com ## added by CiD

O1 - Hosts: 127.0.0.1 dynamique.drivecleaner.com ## added by CiD

O1 - Hosts: 127.0.0.1 errorprotector.com ## added by CiD

O1 - Hosts: 127.0.0.1 errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 es.winantivirus.com ## added by CiD

O1 - Hosts: 127.0.0.1 fr.winantivirus.com ## added by CiD

O1 - Hosts: 127.0.0.1 fr.winfixer.com ## added by CiD

O1 - Hosts: 46 more lines...

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)

O4 - HKLM..\Run: [BlackBerryAutoUpdate] C:\Programme\Gemeinsame Dateien\Research In Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()

O4 - HKLM..\Run: [RoxWatchTray] C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)

O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [TCMMouse ] C:\Programme\TCM Mouse\MouseDrv.exe ()

O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKCU..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: isamonitor.exe = C:\Programme\VidCodecs\isamonitor.exe

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQ\ICQLite\ICQLite.exe (ICQ Ltd.)

O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQ\ICQLite\ICQLite.exe (ICQ Ltd.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)

O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab (Reg Error: Key error.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab (Java Plug-in 1.5.0_08)

O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab (Java Plug-in 1.5.0_10)

O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Java Plug-in 1.5.0_11)

O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)

O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)

O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)

O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0F2A02E8-227A-4A3C-BD3B-40686C7A1E0D}: DhcpNameServer = 192.168.2.1 192.168.2.1

O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.10.11 15:09:52 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.10.09 21:48:26 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe

[2007.08.05 21:25:09 | 018,808,272 | -H-- | C] (Macrovision Corporation) -- C:\Programme\ElsterFormular2006-Setup.exe

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.10.09 21:46:38 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011.10.09 21:34:20 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe

[2011.10.09 21:30:23 | 000,001,014 | -H-- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job

[2011.10.09 21:30:19 | 000,001,086 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2011.10.09 21:12:06 | 000,000,304 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~6DSS92c31Apgjk

[2011.10.09 21:12:06 | 000,000,208 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~6DSS92c31Apgjkr

[2011.10.09 21:11:01 | 000,001,090 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2011.10.09 21:10:23 | 000,000,328 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\6DSS92c31Apgjk

[2011.10.09 21:10:18 | 000,451,072 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\6DSS92c31Apgjk.exe

[2011.10.09 21:09:45 | 000,088,556 | -H-- | M] () -- C:\WINDOWS\System32\nvapps.xml

[2011.10.09 21:03:21 | 000,518,144 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\nXBPpaqQtFIXr.exe

[2011.10.08 19:40:39 | 000,002,422 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.10.09 21:12:06 | 000,000,304 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~6DSS92c31Apgjk

[2011.10.09 21:12:06 | 000,000,208 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~6DSS92c31Apgjkr

[2011.10.09 21:10:23 | 000,000,328 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\6DSS92c31Apgjk

[2011.10.09 21:10:18 | 000,451,072 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\6DSS92c31Apgjk.exe

[2011.10.09 21:03:25 | 000,518,144 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\nXBPpaqQtFIXr.exe

[2011.08.13 18:29:01 | 000,150,566 | -H-- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-1343024091-492894223-839522115-1003-0.dat

[2011.08.13 14:59:26 | 000,150,566 | -H-- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat

[2011.03.13 22:59:58 | 000,101,608 | -H-- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat

[2010.10.29 21:09:08 | 000,032,184 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat

[2010.03.28 20:32:39 | 000,000,256 | -H-- | C] () -- C:\WINDOWS\System32\pool.bin

[2009.02.20 14:21:54 | 000,000,227 | -H-- | C] () -- C:\WINDOWS\HP_CounterReport_Update_HPSU.ini

[2009.02.20 14:21:43 | 000,000,214 | -H-- | C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini

[2009.02.20 14:16:40 | 000,000,221 | -H-- | C] () -- C:\WINDOWS\HP_RedboxHprblog_HPSU.ini

[2008.11.11 22:32:10 | 000,165,376 | -H-- | C] () -- C:\WINDOWS\System32\UNWISE.EXE

[2008.11.11 22:32:10 | 000,006,836 | -H-- | C] () -- C:\WINDOWS\System32\UNWISE.INI

[2008.11.02 16:13:00 | 000,000,050 | -H-- | C] () -- C:\WINDOWS\cdplayer.ini

[2008.03.06 22:00:08 | 000,016,081 | -H-- | C] () -- C:\WINDOWS\German.ini

[2008.03.01 22:38:09 | 002,196,824 | -H-- | C] () -- C:\Programme\O2CSetup.exe

[2007.09.02 13:01:03 | 000,000,221 | -H-- | C] () -- C:\WINDOWS\NCLogConfig.ini

[2007.08.05 21:34:11 | 000,003,202 | -H-- | C] () -- C:\WINDOWS\tm.ini

[2007.07.17 22:43:28 | 000,113,604 | -H-- | C] () -- C:\WINDOWS\hpoins07.dat

[2007.07.17 22:43:28 | 000,021,124 | -H-- | C] () -- C:\WINDOWS\hpomdl07.dat

[2007.07.06 20:19:43 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\wltrysvc.exe

[2007.07.06 20:19:43 | 000,003,078 | -H-- | C] () -- C:\WINDOWS\System32\bcmwlhom.ini

[2007.07.06 20:19:42 | 000,595,968 | -H-- | C] () -- C:\WINDOWS\System32\WatchPower.exe

[2007.07.06 20:19:42 | 000,192,512 | -H-- | C] () -- C:\WINDOWS\System32\AegisI5.exe

[2007.07.06 20:19:42 | 000,114,688 | -H-- | C] () -- C:\WINDOWS\System32\AegisI2.exe

[2007.07.06 20:19:42 | 000,024,576 | -H-- | C] () -- C:\WINDOWS\System32\PowerOff.exe

[2007.06.21 15:51:09 | 000,000,318 | -H-- | C] () -- C:\WINDOWS\WpePro_0delay.INI

[2007.04.30 19:25:33 | 000,000,716 | -H-- | C] () -- C:\WINDOWS\mozver.dat

[2007.02.28 16:21:23 | 000,001,778 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache

[2007.02.28 16:16:28 | 000,051,733 | -H-- | C] () -- C:\WINDOWS\System32\plugin1.dat

[2007.02.28 16:16:27 | 000,033,952 | -H-- | C] () -- C:\WINDOWS\System32\drivers\oreans32.sys

[2007.02.10 22:02:38 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\nsreg.dat

[2006.11.11 18:01:26 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\IFinst27.exe

[2006.11.09 13:26:28 | 000,363,520 | -H-- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2006.11.06 18:25:43 | 000,106,496 | -H-- | C] () -- C:\WINDOWS\System32\sacskza.dll

[2006.10.22 14:33:03 | 000,000,400 | -H-- | C] () -- C:\WINDOWS\ODBC.INI

[2006.10.22 12:22:00 | 001,662,976 | -H-- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2006.10.22 12:22:00 | 001,622,016 | -H-- | C] () -- C:\WINDOWS\System32\nwiz.exe

[2006.10.22 12:22:00 | 001,470,464 | -H-- | C] () -- C:\WINDOWS\System32\nview.dll

[2006.10.22 12:22:00 | 001,339,392 | -H-- | C] () -- C:\WINDOWS\System32\nvdspsch.exe

[2006.10.22 12:22:00 | 001,019,904 | -H-- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2006.10.22 12:22:00 | 000,581,632 | -H-- | C] () -- C:\WINDOWS\System32\nvhwvid.dll

[2006.10.22 12:22:00 | 000,466,944 | -H-- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2006.10.22 12:22:00 | 000,442,368 | -H-- | C] () -- C:\WINDOWS\System32\nvappbar.exe

[2006.10.22 12:22:00 | 000,425,984 | -H-- | C] () -- C:\WINDOWS\System32\keystone.exe

[2006.10.22 12:22:00 | 000,286,720 | -H-- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll

[2006.10.22 12:22:00 | 000,212,992 | -H-- | C] () -- C:\WINDOWS\System32\nvapi.dll

[2006.10.15 22:00:41 | 000,006,550 | -H-- | C] () -- C:\WINDOWS\jautoexp.dat

[2006.10.11 15:43:01 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI

[2006.10.11 15:41:55 | 000,177,056 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2006.10.11 15:12:06 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2006.10.11 15:07:03 | 000,021,740 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2006.07.27 19:28:42 | 003,596,288 | -H-- | C] () -- C:\WINDOWS\System32\qt-dx331.dll

[2006.07.12 01:40:17 | 000,520,192 | -H-- | C] () -- C:\WINDOWS\System32\DivXsm.exe

[2006.07.12 00:33:49 | 000,012,288 | -H-- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll

[2005.07.29 17:21:32 | 000,011,988 | -H-- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys

[2004.12.16 17:32:54 | 000,013,304 | -H-- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys

[2004.08.02 14:20:40 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat

[2002.08.29 14:00:00 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin

[2002.08.29 14:00:00 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat

[2002.08.29 14:00:00 | 000,492,072 | -H-- | C] () -- C:\WINDOWS\System32\perfh007.dat

[2002.08.29 14:00:00 | 000,472,368 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2002.08.29 14:00:00 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2002.08.29 14:00:00 | 000,269,480 | -H-- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2002.08.29 14:00:00 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat

[2002.08.29 14:00:00 | 000,090,330 | -H-- | C] () -- C:\WINDOWS\System32\perfc007.dat

[2002.08.29 14:00:00 | 000,075,462 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2002.08.29 14:00:00 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin

[2002.08.29 14:00:00 | 000,034,478 | -H-- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2002.08.29 14:00:00 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2002.08.29 14:00:00 | 000,027,440 | -H-- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys

[2002.08.29 14:00:00 | 000,004,461 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat

[2002.08.29 14:00:00 | 000,001,788 | -H-- | C] () -- C:\WINDOWS\System32\dcache.bin

[2002.08.29 14:00:00 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat

[2001.07.06 15:30:00 | 000,003,254 | -H-- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
 

< End of report >

--- --- ---

Zitat:

OTL logfile created on: 09.10.2011 21:48:47 - Run 1

Na, hast du das erste Log jetzt doch gefunden?

Eigentlich ist das der File aus der Anleitung die du gepostet hast. Sehr komisch :headbang:

dann mach ich es nochmal. Kann ich mir gerade nicht erklären.
Edit: Es bringt nichts, egal was ich mach er gibt mir bei quick scan/ benutzerdefiniert mit den oben von dir angegebenen Sachen immer das hier heraus
OTL Logfile:

Code:

OTL logfile created on: 09.10.2011 21:48:47 - Run 1

OTL by OldTimer - Version 3.2.29.1     Folder = C:\Dokumente und Einstellungen\Administrator\Desktop

Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 6.0.2900.2180)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

511,48 Mb Total Physical Memory | 383,82 Mb Available Physical Memory | 75,04% Memory free

1,22 Gb Paging File | 1,16 Gb Available in Paging File | 95,35% Paging File free

Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme

Drive C: | 58,59 Gb Total Space | 28,19 Gb Free Space | 48,11% Space Free | Partition Type: NTFS

Drive D: | 53,19 Gb Total Space | 53,08 Gb Free Space | 99,80% Space Free | Partition Type: NTFS

Drive F: | 980,48 Mb Total Space | 333,77 Mb Free Space | 34,04% Space Free | Partition Type: FAT

 

Computer Name: FAMILIE | User Name: Administrator | Logged in as Administrator.

Boot Mode: SafeMode | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.10.09 21:34:20 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe

PRC - [2004.08.04 00:57:54 | 001,035,264 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2006.09.16 22:19:36 | 000,126,976 | -H-- | M] () -- C:\Programme\WinRAR\RarExt.dll

MOD - [2002.08.29 14:00:00 | 000,015,360 | -H-- | M] () -- C:\WINDOWS\system32\tsd32.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - File not found [Auto | Stopped] --  -- (Sound Service)

SRV - [2010.11.04 16:41:46 | 000,009,728 | -H-- | M] (Deutsche Telekom AG) [Auto | Stopped] -- C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe -- (Netzmanager Service)

SRV - [2010.10.16 01:40:40 | 000,037,664 | -H-- | M] (Apple Inc.) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)

SRV - [2010.03.18 12:19:26 | 000,113,152 | -H-- | M] (ArcSoft Inc.) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)

SRV - [2009.07.08 12:31:36 | 000,313,840 | -H-- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe -- (RoxLiveShare9)

SRV - [2009.07.08 12:31:32 | 000,170,480 | -H-- | M] (Sonic Solutions) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe -- (RoxWatch9)

SRV - [2009.07.08 12:31:12 | 001,108,464 | -H-- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe -- (RoxMediaDB9)

SRV - [2007.08.09 09:27:52 | 000,073,728 | -H-- | M] (HP) [Auto | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)

SRV - [2005.04.06 17:03:28 | 000,110,592 | -H-- | M] () [Auto | Stopped] -- C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service)

SRV - [2004.10.22 03:24:18 | 000,073,728 | -H-- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2010.09.16 17:02:33 | 000,035,040 | -H-- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys -- (TelekomNM3)

DRV - [2009.12.01 23:17:42 | 000,579,712 | -H-- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emBDA.sys -- (USB28xxBGA)

DRV - [2009.12.01 23:17:06 | 000,543,744 | -H-- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\emOEM.sys -- (USB28xxOEM)

DRV - [2008.03.06 22:14:06 | 000,097,792 | -H-- | M] (Protect Software GmbH) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\ACEDRV05.sys -- (ACEDRV05)

DRV - [2007.02.28 16:16:27 | 000,033,952 | -H-- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\oreans32.sys -- (oreans32)

DRV - [2007.02.26 11:45:11 | 000,022,768 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbsermpt.sys -- (usbsermpt)

DRV - [2006.04.12 15:43:50 | 000,169,472 | -H-- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8187.sys -- (RTLWUSB)

DRV - [2005.10.23 18:25:12 | 000,023,000 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btcusb.sys -- (Btcsrusb)

DRV - [2005.10.23 18:21:42 | 000,010,068 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BtNetDrv.sys -- (BT)

DRV - [2005.08.31 11:34:52 | 000,020,480 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BlueletSCOAudio.sys -- (BlueletSCOAudio)

DRV - [2005.08.31 11:34:10 | 000,020,480 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\blueletaudio.sys -- (BlueletAudio)

DRV - [2005.07.29 17:21:32 | 000,011,988 | -H-- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\vbtenum.sys -- (BTHidEnum)

DRV - [2005.04.30 15:50:10 | 000,028,271 | -H-- | M] (IVT Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys -- (BTHidMgr)

DRV - [2005.03.25 18:18:48 | 000,082,148 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VcommMgr.sys -- (VcommMgr)

DRV - [2004.12.16 17:32:54 | 000,013,304 | -H-- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BTNetFilter.sys -- (BTNetFilter)

DRV - [2004.12.11 22:28:20 | 000,371,584 | RH-- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)

DRV - [2004.10.19 14:37:38 | 000,061,312 | -H-- | M] (IVT Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\VComm.sys -- (VComm)

DRV - [2004.08.03 23:10:14 | 000,015,360 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mpe.sys -- (MPE)

DRV - [2003.01.10 10:34:32 | 000,695,852 | RH-- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)

DRV - [2002.07.24 04:30:00 | 000,032,128 | -H-- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\viaagp1.sys -- (viaagp1)

DRV - [2001.08.17 14:53:32 | 000,003,328 | -H-- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\qv2kux.sys -- (QV2KUX)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

 

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\System32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)

FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Programme\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@pack.google.com/Google Updater;version=13: C:\Programme\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll (Google)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2536: C:\Programme\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2594: C:\Programme\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.1698: C:\Programme\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found

FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Programme\Gemeinsame Dateien\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.09.08 20:23:42 | 000,000,000 | -H-D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.08.18 10:51:06 | 000,000,000 | -H-D | M]

 

[2011.08.18 10:51:08 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2007.06.05 15:53:04 | 000,000,000 | -H-D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

[2011.08.08 11:15:02 | 000,000,000 | -H-D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

[2011.09.08 20:23:42 | 000,134,104 | -H-- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll

[2011.08.08 11:14:35 | 000,476,904 | -H-- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll

[2006.07.31 16:07:16 | 000,098,304 | -H-- | M] (Zylom) -- C:\Programme\mozilla firefox\plugins\npzylomgamesplayer.dll

[2011.08.12 06:19:37 | 000,001,392 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml

[2011.08.12 06:14:12 | 000,002,252 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml

[2011.08.12 06:19:37 | 000,001,153 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml

[2011.08.12 06:19:37 | 000,006,805 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml

[2011.08.12 06:19:37 | 000,001,178 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml

[2011.08.12 06:19:37 | 000,001,105 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2007.03.02 14:46:58 | 000,004,188 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: 127.0.0.1 bin.errorprotector.com ## added by CiD

O1 - Hosts: 127.0.0.1 br.errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 br.winantivirus.com ## added by CiD

O1 - Hosts: 127.0.0.1 br.winfixer.com ## added by CiD

O1 - Hosts: 127.0.0.1 cdn.drivecleaner.com ## added by CiD

O1 - Hosts: 127.0.0.1 cdn.errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 cdn.winsoftware.com ## added by CiD

O1 - Hosts: 127.0.0.1 de.errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 de.winantivirus.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.cdn.drivecleaner.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.cdn.errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.cdn.winsoftware.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.systemdoctor.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.winantispyware.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.windrivecleaner.com ## added by CiD

O1 - Hosts: 127.0.0.1 download.winfixer.com ## added by CiD

O1 - Hosts: 127.0.0.1 drivecleaner.com ## added by CiD

O1 - Hosts: 127.0.0.1 dynamique.drivecleaner.com ## added by CiD

O1 - Hosts: 127.0.0.1 errorprotector.com ## added by CiD

O1 - Hosts: 127.0.0.1 errorsafe.com ## added by CiD

O1 - Hosts: 127.0.0.1 es.winantivirus.com ## added by CiD

O1 - Hosts: 127.0.0.1 fr.winantivirus.com ## added by CiD

O1 - Hosts: 127.0.0.1 fr.winfixer.com ## added by CiD

O1 - Hosts: 46 more lines...

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)

O4 - HKLM..\Run: []  File not found

O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Programme\Gemeinsame Dateien\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)

O4 - HKLM..\Run: [BlackBerryAutoUpdate] C:\Programme\Gemeinsame Dateien\Research In Motion\Auto Update\RIMAutoUpdate.exe (Research In Motion Limited)

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()

O4 - HKLM..\Run: [RoxWatchTray] C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)

O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [TCMMouse ] C:\Programme\TCM Mouse\MouseDrv.exe ()

O4 - HKLM..\Run: [TkBellExe] C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKCU..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: isamonitor.exe = C:\Programme\VidCodecs\isamonitor.exe

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQ\ICQLite\ICQLite.exe (ICQ Ltd.)

O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQ\ICQLite\ICQLite.exe (ICQ Ltd.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)

O16 - DPF: {33564D57-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab (Reg Error: Key error.)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab (Java Plug-in 1.5.0_08)

O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab (Java Plug-in 1.5.0_10)

O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Java Plug-in 1.5.0_11)

O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)

O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)

O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)

O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{0F2A02E8-227A-4A3C-BD3B-40686C7A1E0D}: DhcpNameServer = 192.168.2.1 192.168.2.1

O18 - Protocol\Handler\cdo {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.10.11 15:09:52 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.10.09 21:48:26 | 000,582,656 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe

[2007.08.05 21:25:09 | 018,808,272 | -H-- | C] (Macrovision Corporation) -- C:\Programme\ElsterFormular2006-Setup.exe

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.10.09 21:46:38 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2011.10.09 21:34:20 | 000,582,656 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Administrator\Desktop\OTL.exe

[2011.10.09 21:30:23 | 000,001,014 | -H-- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job

[2011.10.09 21:30:19 | 000,001,086 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2011.10.09 21:12:06 | 000,000,304 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~6DSS92c31Apgjk

[2011.10.09 21:12:06 | 000,000,208 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~6DSS92c31Apgjkr

[2011.10.09 21:11:01 | 000,001,090 | -H-- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2011.10.09 21:10:23 | 000,000,328 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\6DSS92c31Apgjk

[2011.10.09 21:10:18 | 000,451,072 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\6DSS92c31Apgjk.exe

[2011.10.09 21:09:45 | 000,088,556 | -H-- | M] () -- C:\WINDOWS\System32\nvapps.xml

[2011.10.09 21:03:21 | 000,518,144 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\nXBPpaqQtFIXr.exe

[2011.10.08 19:40:39 | 000,002,422 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.10.09 21:12:06 | 000,000,304 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~6DSS92c31Apgjk

[2011.10.09 21:12:06 | 000,000,208 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~6DSS92c31Apgjkr

[2011.10.09 21:10:23 | 000,000,328 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\6DSS92c31Apgjk

[2011.10.09 21:10:18 | 000,451,072 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\6DSS92c31Apgjk.exe

[2011.10.09 21:03:25 | 000,518,144 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\nXBPpaqQtFIXr.exe

[2011.08.13 18:29:01 | 000,150,566 | -H-- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-S-1-5-21-1343024091-492894223-839522115-1003-0.dat

[2011.08.13 14:59:26 | 000,150,566 | -H-- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat

[2011.03.13 22:59:58 | 000,101,608 | -H-- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat

[2010.10.29 21:09:08 | 000,032,184 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat

[2010.03.28 20:32:39 | 000,000,256 | -H-- | C] () -- C:\WINDOWS\System32\pool.bin

[2009.02.20 14:21:54 | 000,000,227 | -H-- | C] () -- C:\WINDOWS\HP_CounterReport_Update_HPSU.ini

[2009.02.20 14:21:43 | 000,000,214 | -H-- | C] () -- C:\WINDOWS\HP_48BitScanUpdatePatch.ini

[2009.02.20 14:16:40 | 000,000,221 | -H-- | C] () -- C:\WINDOWS\HP_RedboxHprblog_HPSU.ini

[2008.11.11 22:32:10 | 000,165,376 | -H-- | C] () -- C:\WINDOWS\System32\UNWISE.EXE

[2008.11.11 22:32:10 | 000,006,836 | -H-- | C] () -- C:\WINDOWS\System32\UNWISE.INI

[2008.11.02 16:13:00 | 000,000,050 | -H-- | C] () -- C:\WINDOWS\cdplayer.ini

[2008.03.06 22:00:08 | 000,016,081 | -H-- | C] () -- C:\WINDOWS\German.ini

[2008.03.01 22:38:09 | 002,196,824 | -H-- | C] () -- C:\Programme\O2CSetup.exe

[2007.09.02 13:01:03 | 000,000,221 | -H-- | C] () -- C:\WINDOWS\NCLogConfig.ini

[2007.08.05 21:34:11 | 000,003,202 | -H-- | C] () -- C:\WINDOWS\tm.ini

[2007.07.17 22:43:28 | 000,113,604 | -H-- | C] () -- C:\WINDOWS\hpoins07.dat

[2007.07.17 22:43:28 | 000,021,124 | -H-- | C] () -- C:\WINDOWS\hpomdl07.dat

[2007.07.06 20:19:43 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\System32\wltrysvc.exe

[2007.07.06 20:19:43 | 000,003,078 | -H-- | C] () -- C:\WINDOWS\System32\bcmwlhom.ini

[2007.07.06 20:19:42 | 000,595,968 | -H-- | C] () -- C:\WINDOWS\System32\WatchPower.exe

[2007.07.06 20:19:42 | 000,192,512 | -H-- | C] () -- C:\WINDOWS\System32\AegisI5.exe

[2007.07.06 20:19:42 | 000,114,688 | -H-- | C] () -- C:\WINDOWS\System32\AegisI2.exe

[2007.07.06 20:19:42 | 000,024,576 | -H-- | C] () -- C:\WINDOWS\System32\PowerOff.exe

[2007.06.21 15:51:09 | 000,000,318 | -H-- | C] () -- C:\WINDOWS\WpePro_0delay.INI

[2007.04.30 19:25:33 | 000,000,716 | -H-- | C] () -- C:\WINDOWS\mozver.dat

[2007.02.28 16:21:23 | 000,001,778 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache

[2007.02.28 16:16:28 | 000,051,733 | -H-- | C] () -- C:\WINDOWS\System32\plugin1.dat

[2007.02.28 16:16:27 | 000,033,952 | -H-- | C] () -- C:\WINDOWS\System32\drivers\oreans32.sys

[2007.02.10 22:02:38 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\nsreg.dat

[2006.11.11 18:01:26 | 000,065,536 | -H-- | C] () -- C:\WINDOWS\IFinst27.exe

[2006.11.09 13:26:28 | 000,363,520 | -H-- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2006.11.06 18:25:43 | 000,106,496 | -H-- | C] () -- C:\WINDOWS\System32\sacskza.dll

[2006.10.22 14:33:03 | 000,000,400 | -H-- | C] () -- C:\WINDOWS\ODBC.INI

[2006.10.22 12:22:00 | 001,662,976 | -H-- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll

[2006.10.22 12:22:00 | 001,622,016 | -H-- | C] () -- C:\WINDOWS\System32\nwiz.exe

[2006.10.22 12:22:00 | 001,470,464 | -H-- | C] () -- C:\WINDOWS\System32\nview.dll

[2006.10.22 12:22:00 | 001,339,392 | -H-- | C] () -- C:\WINDOWS\System32\nvdspsch.exe

[2006.10.22 12:22:00 | 001,019,904 | -H-- | C] () -- C:\WINDOWS\System32\nvwimg.dll

[2006.10.22 12:22:00 | 000,581,632 | -H-- | C] () -- C:\WINDOWS\System32\nvhwvid.dll

[2006.10.22 12:22:00 | 000,466,944 | -H-- | C] () -- C:\WINDOWS\System32\nvshell.dll

[2006.10.22 12:22:00 | 000,442,368 | -H-- | C] () -- C:\WINDOWS\System32\nvappbar.exe

[2006.10.22 12:22:00 | 000,425,984 | -H-- | C] () -- C:\WINDOWS\System32\keystone.exe

[2006.10.22 12:22:00 | 000,286,720 | -H-- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll

[2006.10.22 12:22:00 | 000,212,992 | -H-- | C] () -- C:\WINDOWS\System32\nvapi.dll

[2006.10.15 22:00:41 | 000,006,550 | -H-- | C] () -- C:\WINDOWS\jautoexp.dat

[2006.10.11 15:43:01 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI

[2006.10.11 15:41:55 | 000,177,056 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2006.10.11 15:12:06 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2006.10.11 15:07:03 | 000,021,740 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

[2006.07.27 19:28:42 | 003,596,288 | -H-- | C] () -- C:\WINDOWS\System32\qt-dx331.dll

[2006.07.12 01:40:17 | 000,520,192 | -H-- | C] () -- C:\WINDOWS\System32\DivXsm.exe

[2006.07.12 00:33:49 | 000,012,288 | -H-- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll

[2005.07.29 17:21:32 | 000,011,988 | -H-- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys

[2004.12.16 17:32:54 | 000,013,304 | -H-- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys

[2004.08.02 14:20:40 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat

[2002.08.29 14:00:00 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin

[2002.08.29 14:00:00 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat

[2002.08.29 14:00:00 | 000,492,072 | -H-- | C] () -- C:\WINDOWS\System32\perfh007.dat

[2002.08.29 14:00:00 | 000,472,368 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat

[2002.08.29 14:00:00 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat

[2002.08.29 14:00:00 | 000,269,480 | -H-- | C] () -- C:\WINDOWS\System32\perfi007.dat

[2002.08.29 14:00:00 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat

[2002.08.29 14:00:00 | 000,090,330 | -H-- | C] () -- C:\WINDOWS\System32\perfc007.dat

[2002.08.29 14:00:00 | 000,075,462 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat

[2002.08.29 14:00:00 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin

[2002.08.29 14:00:00 | 000,034,478 | -H-- | C] () -- C:\WINDOWS\System32\perfd007.dat

[2002.08.29 14:00:00 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat

[2002.08.29 14:00:00 | 000,027,440 | -H-- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys

[2002.08.29 14:00:00 | 000,004,461 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat

[2002.08.29 14:00:00 | 000,001,788 | -H-- | C] () -- C:\WINDOWS\System32\dcache.bin

[2002.08.29 14:00:00 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat

[2001.07.06 15:30:00 | 000,003,254 | -H-- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI
 

< End of report >

--- --- ---

Ja ich weiß dort steht wieder Run 1 aber ich kann es nicht ändern. (das steht dort irgendwie immer... )

Zitat:

OTL logfile created on: 09.10.2011 21:48:47 - Run 1

Du postest ständig das alte Log...