Trojaner-Board - Rechnung.exe - Rechner reagiert auf nichts

Hallo mein Schwager hat folgendes Problem:

er hat eine E-Mail erhalten mit einer "Mahnung" diese E-Mail hatte ein
zip im Anhang und in diesem Zip eine "Rechnung.exe" diese hat er leider
ausgeführt.

Nun passiert folgendes wenn man den Rechner bootet sofort nach dem Windof
Start wird ein Bild angezeigt "Bundespolizei... Rechner ist gesperrt bis
das Geld überwiesen wurde....". Man kann auch nichts weiter machen Taskmanager lässt sich nicht öffnen.

Ich hab jetzt von OTLPE CD gebootet und den Quickscann durchgeführt.
Leider gibt es nur ein Logfile (OTL.txt) das angesprochene Extra.txt gibt es nicht.

OS: Vista 64 bit Ultimate

----------------------------------
OTL.log
----------------------------------
Code:


OTL logfile created on: 7/20/2012 7:18:07 PM - Run 

OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE

64bit-Windows Vista (TM) Ultimate Service Pack 2 (Version = 6.0.6002) - Type = System

Internet Explorer (Version = 8.0.6001.19272)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

 

2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 83.00% Memory free

2.00 Gb Paging File | 2.00 Gb Available in Paging File | 94.00% Paging File free

Paging file location(s): ?:\pagefile.sys

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 50.78 Gb Total Space | 6.83 Gb Free Space | 13.45% Space Free | Partition Type: NTFS

Drive D: | 182.10 Gb Total Space | 163.22 Gb Free Space | 89.63% Space Free | Partition Type: NTFS

Drive E: | 1.92 Gb Total Space | 1.89 Gb Free Space | 98.71% Space Free | Partition Type: FAT32

Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

 

Computer Name: REATOGO | User Name: SYSTEM

Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

Using ControlSet: ControlSet001

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - [2009/07/20 07:36:14 | 000,160,784 | ---- | M] (Logitech, Inc.) [On_Demand] -- C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe -- (LBTServ)

SRV:64bit: - [2008/01/19 04:06:50 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV:64bit: - [2008/01/19 04:00:52 | 000,195,584 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\appmgmts.dll -- (AppMgmt)

SRV:64bit: - [2007/05/10 21:14:24 | 001,418,248 | ---- | M] (O&O Software GmbH) [Auto] -- C:\Windows\System32\oodag.exe -- (O&O Defrag)

SRV - [2012/07/14 06:04:42 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012/01/03 09:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2010/07/21 11:29:23 | 000,921,952 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files (x86)\AVG\AVG9\avgemc.exe -- (avg9emc)

SRV - [2010/07/17 14:52:38 | 000,308,136 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto] -- C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe -- (avg9wd)

SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009/03/30 00:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2007/12/27 10:39:30 | 000,166,520 | ---- | M] () [Auto] -- C:\Program Files (x86)\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service)

SRV - [2007/12/27 10:39:20 | 000,051,816 | ---- | M] () [Auto] -- C:\Program Files (x86)\IVT Corporation\BlueSoleil\StartSkysolSvc.exe -- (Start BT in service)

SRV - [2006/10/23 08:50:35 | 000,046,640 | R--- | M] (AOL LLC) [Auto] -- C:\Program Files (x86)\Common Files\AOL\ACS\AOLAcsd.exe -- (AOL ACS)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2012/04/25 06:11:36 | 000,052,736 | ---- | M] (Apple, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbaapl64.sys -- (USBAAPL64)

DRV:64bit: - [2011/09/12 13:15:26 | 000,035,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System] -- C:\Windows\System32\Drivers\avgmfx64.sys -- (AvgMfx64)

DRV:64bit: - [2011/05/06 15:07:05 | 000,317,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- C:\Windows\System32\Drivers\avgtdia.sys -- (AvgTdiA)

DRV:64bit: - [2010/07/17 14:52:26 | 000,269,904 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System] -- C:\Windows\System32\Drivers\avgldx64.sys -- (AvgLdx64)

DRV:64bit: - [2009/09/30 20:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\WpdUsb.sys -- (WpdUsb)

DRV:64bit: - [2009/09/05 09:27:12 | 001,449,984 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\athrx.sys -- (athr)

DRV:64bit: - [2009/06/17 12:54:46 | 000,040,976 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt)

DRV:64bit: - [2009/06/17 12:54:30 | 000,057,872 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)

DRV:64bit: - [2009/06/17 12:54:22 | 000,055,312 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)

DRV:64bit: - [2009/06/17 12:53:34 | 000,030,736 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\L8042Kbd.sys -- (L8042Kbd)

DRV:64bit: - [2008/11/29 02:19:28 | 000,028,208 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand] -- C:\Windows\System32\drivers\KMWDFILTER.sys -- (KMWDFILTER)

DRV:64bit: - [2008/01/19 02:38:16 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\rootmdm.sys -- (ROOTMODEM)

DRV:64bit: - [2007/06/24 16:56:56 | 000,047,368 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\btcusb.sys -- (Btcsrusb)

DRV:64bit: - [2007/06/24 16:56:42 | 000,037,384 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\BlueletSCOAudio.sys -- (BlueletSCOAudio)

DRV:64bit: - [2007/06/24 16:56:36 | 000,037,896 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\blueletaudio.sys -- (BlueletAudio)

DRV:64bit: - [2007/03/05 15:47:08 | 000,025,360 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\BtNetDrv.sys -- (BT)

DRV:64bit: - [2007/03/05 15:42:54 | 000,049,680 | ---- | M] (IVT Corporation.) [Kernel | Boot] -- C:\Windows\System32\drivers\BTHidMgr.sys -- (BTHidMgr)

DRV:64bit: - [2007/03/05 15:41:34 | 000,024,976 | ---- | M] (IVT Corporation.) [Kernel | Boot] -- C:\Windows\System32\drivers\VBTEnum.sys -- (BTHidEnum)

DRV:64bit: - [2007/03/05 15:39:28 | 000,063,248 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\VcommMgr.sys -- (VcommMgr)

DRV:64bit: - [2007/03/05 15:38:20 | 000,047,120 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\VComm.sys -- (VComm)

DRV:64bit: - [2007/02/07 06:18:06 | 001,095,168 | ---- | M] (C-Media Inc) [Kernel | On_Demand] -- C:\Windows\System32\drivers\c6501.sys -- (c65013264)

DRV:64bit: - [2006/11/29 18:24:49 | 000,024,064 | ---- | M] (America Online, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wanatw64.sys -- (wanatw) WAN Miniport (ATW)

DRV:64bit: - [2006/10/31 11:23:42 | 000,015,680 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)

DRV:64bit: - [2006/09/18 17:36:24 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- C:\Windows\System32\wbem\ntfs.mof -- (Ntfs)

DRV - [2007/06/24 16:56:56 | 000,047,368 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\Windows\SysWOW64\drivers\btcusb.sys -- (Btcsrusb)

DRV - [2007/06/24 16:56:42 | 000,037,384 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\Windows\SysWOW64\drivers\BlueletSCOAudio.sys -- (BlueletSCOAudio)

DRV - [2007/06/24 16:56:36 | 000,037,896 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\Windows\SysWOW64\drivers\blueletaudio.sys -- (BlueletAudio)

DRV - [2007/03/05 15:47:08 | 000,025,360 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\Windows\SysWOW64\drivers\btnetdrv.sys -- (BT)

DRV - [2007/03/05 15:42:54 | 000,049,680 | ---- | M] (IVT Corporation.) [Kernel | Boot] -- C:\Windows\SysWOW64\drivers\BtHidMgr.sys -- (BTHidMgr)

DRV - [2007/03/05 15:41:34 | 000,024,976 | ---- | M] (IVT Corporation.) [Kernel | Boot] -- C:\Windows\SysWOW64\drivers\VBTEnum.sys -- (BTHidEnum)

DRV - [2007/03/05 15:39:28 | 000,063,248 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\Windows\SysWOW64\drivers\VCommMgr.sys -- (VcommMgr)

DRV - [2007/03/05 15:38:20 | 000,047,120 | ---- | M] (IVT Corporation.) [Kernel | On_Demand] -- C:\Windows\SysWOW64\drivers\VComm.sys -- (VComm)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

 

 

IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - Reg Error: Key error. File not found

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 

IE - HKU\Familie_Fritsche_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKU\Familie_Fritsche_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKU\Familie_Fritsche_ON_C\..\URLSearchHook: {1CFFA392-0898-4b1c-89D1-6E98F9D8EF78} - Reg Error: Key error. File not found

IE - HKU\Familie_Fritsche_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\Familie_Fritsche_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

 

 

 

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=:  

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\Wow6432Node\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()

FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

 

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files (x86)\AVG\AVG9\Firefox [2011/09/12 13:20:04 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 14.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/07/14 06:04:44 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 14.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012/04/11 11:53:37 | 000,000,000 | ---D | M]

 

[2012/03/31 16:59:21 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions

[2012/07/14 06:04:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\distribution\extensions

[2012/07/14 06:04:44 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll

[2012/01/05 12:29:14 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll

[2012/06/19 14:12:22 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2012/06/19 14:12:22 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml

[2012/06/19 14:12:22 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2012/06/19 14:12:22 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2012/06/19 14:12:22 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2012/06/19 14:12:22 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2006/09/18 17:37:24 | 000,000,736 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: ::1             localhost

O2:64bit: - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (AOL Toolbar Launcher) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files (x86)\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC)

O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.

O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files (x86)\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC)

O3 - HKU\Familie_Fritsche_ON_C\..\Toolbar\WebBrowser: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.

O3 - HKU\Familie_Fritsche_ON_C\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files (x86)\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC)

O4:64bit: - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)

O4:64bit: - HKLM..\Run: [OODefragTray] C:\Windows\System32\oodtray.exe (O&O Software GmbH)

O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)

O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files (x86)\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)

O4 - HKU\LocalService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)

O4 - HKU\NetworkService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)

O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O9 - Extra Button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files (x86)\AOL\AOL Toolbar 4.0\aoltb.dll (AOL LLC)

O10:64bit: - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)

O13:64bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O15:64bit: - Familie_Fritsche_ON_C\..Trusted Domains: aol.com ([objects] * is out of zone range -  5)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O18:64bit: - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.)

O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found

O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\SysWOW64\Skype4COM.dll (Skype Technologies)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\System32\DreamScene.dll (Microsoft Corporation)

O24 - Desktop WallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: B:\Documents and Settings\Default User\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O34 - HKLM BootExecute: (OODBS) -  File not found
 64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
 64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2012/07/08 15:08:01 | 000,000,000 | ---D | C] -- C:\Users\Familie Fritsche\AppData\Local\Apple Computer

[2012/07/08 15:08:00 | 000,000,000 | ---D | C] -- C:\Users\Familie Fritsche\AppData\Roaming\Apple Computer

[2012/07/08 15:07:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

[2012/07/08 15:07:46 | 000,000,000 | ---D | C] -- C:\Windows\System32\DRVSTORE

[2012/07/08 15:06:40 | 000,000,000 | ---D | C] -- C:\Program Files\iPod

[2012/07/08 15:06:38 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes

[2012/07/08 15:06:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes

[2012/07/08 15:06:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer

[2012/07/08 15:06:38 | 000,000,000 | ---D | C] -- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}

[2012/07/08 15:06:11 | 000,000,000 | ---D | C] -- C:\Users\Familie Fritsche\AppData\Local\Apple

[2012/07/08 15:06:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update

[2012/07/08 15:05:01 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple

[2012/07/08 15:04:35 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour

[2012/07/08 15:04:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour

[2012/07/08 15:04:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple

[2012/07/08 15:04:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple

 
 ========== Files - Modified Within 30 Days ==========

 

[2012/07/20 03:14:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012/07/20 03:14:46 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat

[2012/07/20 03:14:27 | 000,091,173 | ---- | M] () -- C:\ProgramData\nvModes.dat

[2012/07/20 03:14:24 | 000,004,080 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012/07/20 03:14:24 | 000,004,080 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012/07/20 03:14:19 | 000,071,781 | ---- | M] () -- C:\ProgramData\nvModes.001

[2012/07/20 03:14:19 | 000,000,534 | ---- | M] () -- C:\Windows\tasks\1-Klick-Wartung.job

[2012/07/20 03:14:12 | 2145,902,592 | -HS- | M] () -- C:\hiberfil.sys

[2012/07/20 03:14:10 | 002,093,003 | ---- | M] () -- C:\Windows\System32\oodbs.lor

[2012/07/20 02:57:12 | 000,071,781 | ---- | M] () -- C:\ProgramData\sJTvydraGqlroGQDf

[2012/07/20 02:49:59 | 101,771,502 | ---- | M] () -- C:\Windows\System32\drivers\Avg\incavi.avm

[2012/07/19 15:54:34 | 000,000,440 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{EB7F23E6-BE35-4F96-9828-155F7C56D2B6}.job

[2012/07/11 14:07:27 | 000,256,688 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012/07/08 15:07:53 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

[2012/07/08 15:06:08 | 000,001,830 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk

[2012/07/02 12:49:07 | 000,000,000 | ---- | M] () -- C:\Users\Familie Fritsche\AppData\Local\prvlcl.dat

 
 ========== Files Created - No Company Name ==========

 

[2012/07/20 02:59:57 | 000,071,781 | ---- | C] () -- C:\ProgramData\nvModes.001

[2012/07/08 15:06:08 | 000,001,830 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk

[2012/01/29 10:42:34 | 000,000,466 | RHS- | C] () -- C:\ProgramData\ntuser.pol

[2012/01/05 12:33:06 | 000,100,352 | ---- | C] () -- C:\Windows\SysWow64\zlib1.dll

[2012/01/05 12:33:05 | 000,162,304 | ---- | C] () -- C:\Windows\SysWow64\libpng13.dll

[2012/01/05 12:33:03 | 001,179,595 | ---- | C] () -- C:\Windows\unins002.exe

[2012/01/05 12:33:03 | 000,012,816 | ---- | C] () -- C:\Windows\unins002.dat

[2012/01/05 12:26:33 | 000,709,719 | ---- | C] () -- C:\Windows\unins001.exe

[2012/01/05 12:26:33 | 000,007,976 | ---- | C] () -- C:\Windows\unins001.dat

[2012/01/05 12:25:21 | 001,199,175 | ---- | C] () -- C:\Windows\unins000.exe

[2012/01/05 12:25:21 | 000,012,173 | ---- | C] () -- C:\Windows\unins000.dat

[2012/01/05 12:23:02 | 001,546,884 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2011/06/03 13:59:31 | 000,000,000 | ---- | C] () -- C:\Users\Familie Fritsche\AppData\Local\prvlcl.dat

[2011/03/28 12:10:13 | 000,000,680 | ---- | C] () -- C:\Users\Familie Fritsche\AppData\Local\d3d9caps.dat

[2011/02/01 15:30:20 | 000,091,173 | ---- | C] () -- C:\ProgramData\nvModes.dat

[2009/09/24 10:19:13 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll

[2009/09/24 10:18:24 | 000,107,612 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchema.bin

[2009/09/24 10:17:13 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2009/07/09 13:47:12 | 000,000,760 | ---- | C] () -- C:\Users\Familie Fritsche\AppData\Roaming\setup_ldm.iss

[2008/12/23 11:34:45 | 000,000,010 | ---- | C] () -- C:\Windows\WININIT.INI

[2008/12/09 10:25:21 | 000,111,932 | ---- | C] () -- C:\Windows\SysWow64\EPPICPrinterDB.dat

[2008/12/09 10:25:21 | 000,031,053 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern131.dat

[2008/12/09 10:25:21 | 000,027,417 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern121.dat

[2008/12/09 10:25:21 | 000,026,154 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern1.dat

[2008/12/09 10:25:21 | 000,024,903 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern3.dat

[2008/12/09 10:25:21 | 000,021,390 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern5.dat

[2008/12/09 10:25:21 | 000,020,148 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern2.dat

[2008/12/09 10:25:21 | 000,011,811 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern4.dat

[2008/12/09 10:25:21 | 000,004,943 | ---- | C] () -- C:\Windows\SysWow64\EPPICPattern6.dat

[2008/12/09 10:25:21 | 000,001,146 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_DU.dat

[2008/12/09 10:25:21 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_PT.dat

[2008/12/09 10:25:21 | 000,001,139 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_BP.dat

[2008/12/09 10:25:21 | 000,001,136 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_ES.dat

[2008/12/09 10:25:21 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_FR.dat

[2008/12/09 10:25:21 | 000,001,129 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_CF.dat

[2008/12/09 10:25:21 | 000,001,120 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_IT.dat

[2008/12/09 10:25:21 | 000,001,107 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_GE.dat

[2008/12/09 10:25:21 | 000,001,104 | ---- | C] () -- C:\Windows\SysWow64\EPPICPresetData_EN.dat

[2008/12/09 10:25:21 | 000,000,097 | ---- | C] () -- C:\Windows\SysWow64\PICSDK.ini

[2008/09/18 14:00:57 | 000,018,904 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin

[2008/07/20 10:30:26 | 000,049,152 | ---- | C] () -- C:\Windows\SysWow64\c6501rm.dll

[2008/07/20 10:30:20 | 000,000,281 | R--- | C] () -- C:\Windows\c6501.ini

[2008/07/12 07:02:26 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat

[2008/05/30 07:57:54 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini

[2008/02/09 15:04:33 | 000,000,000 | ---- | C] () -- C:\Windows\OpPrintServer.INI

[2008/02/01 16:01:38 | 000,024,576 | ---- | C] () -- C:\Windows\SysWow64\AsIO.dll

[2008/02/01 16:01:38 | 000,013,632 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsIO.sys

[2008/02/01 16:01:36 | 000,012,096 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp64.sys

[2008/02/01 16:01:36 | 000,010,304 | ---- | C] () -- C:\Windows\SysWow64\drivers\AsInsHelp32.sys

[2008/02/01 15:48:51 | 000,003,972 | ---- | C] () -- C:\Windows\SysWow64\drivers\PciBus.sys

[2008/01/27 19:05:39 | 000,000,335 | ---- | C] () -- C:\Windows\nsreg.dat

[2008/01/27 18:11:56 | 000,000,000 | ---- | C] () -- C:\Windows\oodcnt.INI

[2008/01/25 18:09:27 | 000,009,872 | ---- | C] () -- C:\Windows\Ascd_tmp.ini

[2008/01/25 18:09:21 | 000,010,288 | ---- | C] () -- C:\Windows\SysWow64\drivers\ASUSHWIO.SYS

[2008/01/25 16:44:00 | 000,029,696 | ---- | C] () -- C:\Users\Familie Fritsche\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2007/01/16 03:49:22 | 000,065,536 | R--- | C] () -- C:\Windows\VMix.dll

[2006/11/02 11:35:48 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006/11/02 11:00:58 | 000,197,632 | ---- | C] () -- C:\Windows\SysWow64\ir32_32.dll

[2006/11/02 08:37:14 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat

[2006/11/02 08:24:17 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT

[2006/11/02 08:18:17 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

[2006/11/02 05:47:54 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006/10/09 10:29:22 | 000,032,832 | ---- | C] () -- C:\Windows\SysWow64\drivers\BTNetFilter.sys

[1601/02/13 04:28:18 | 000,071,781 | ---- | C] () -- C:\ProgramData\sJTvydraGqlroGQDf

 
 ========== LOP Check ==========

 

[2008/01/27 15:39:49 | 000,000,000 | ---D | M] -- C:\Users\Familie Fritsche\AppData\Roaming\acccore

[2011/02/01 15:39:57 | 000,000,000 | ---D | M] -- C:\Users\Familie Fritsche\AppData\Roaming\OpenOffice.org

[2008/12/09 10:26:26 | 000,000,000 | ---D | M] -- C:\Users\Familie Fritsche\AppData\Roaming\Panasonic

[2008/01/27 18:13:52 | 000,000,000 | ---D | M] -- C:\Users\Familie Fritsche\AppData\Roaming\TuneUp Software

[2008/01/25 16:21:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten

[2006/11/02 11:41:02 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data

[2010/02/28 12:16:12 | 000,000,000 | ---D | M] -- C:\ProgramData\avg9

[2008/12/05 04:39:51 | 000,000,000 | ---D | M] -- C:\ProgramData\Bluetooth

[2011/03/14 15:13:11 | 000,000,000 | -H-D | M] -- C:\ProgramData\Common Files

[2006/11/02 11:41:02 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop

[2006/11/02 11:41:02 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents

[2008/01/25 16:21:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente

[2008/02/14 15:39:45 | 000,000,000 | ---D | M] -- C:\ProgramData\eMule

[2008/01/25 16:21:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten

[2006/11/02 11:41:02 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites

[2011/05/05 05:39:36 | 000,000,000 | ---D | M] -- C:\ProgramData\Installations

[2012/06/11 10:12:23 | 000,000,000 | ---D | M] -- C:\ProgramData\MFAData

[2012/01/05 12:54:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Napster

[2006/11/02 11:41:02 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu

[2008/01/25 16:21:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü

[2012/06/11 09:37:28 | 000,000,000 | ---D | M] -- C:\ProgramData\Temp

[2006/11/02 11:41:02 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates

[2012/01/24 13:28:56 | 000,000,000 | ---D | M] -- C:\ProgramData\tmp

[2008/01/27 15:38:04 | 000,000,000 | ---D | M] -- C:\ProgramData\Viewpoint

[2008/01/25 16:21:49 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen

[2012/07/08 15:07:45 | 000,000,000 | ---D | M] -- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}

[2012/07/20 03:14:19 | 000,000,534 | ---- | M] () -- C:\Windows\Tasks\1-Klick-Wartung.job

[2012/07/20 03:14:46 | 000,032,558 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2012/07/19 15:54:34 | 000,000,440 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{EB7F23E6-BE35-4F96-9828-155F7C56D2B6}.job

 
 ========== Purity Check ==========

 

 

< End of report >
--------------------------------------------

Ich hoffe ich habe alle Regeln befolgt und alle nötigen Infos bereitgestellt.

Vielen Dank schon mal vorab für eure Hilfe.

MFG