Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Hilfe bundespolizei trojaner !!! (https://www.trojaner-board.de/102696-hilfe-bundespolizei-trojaner.html)

kaitokito21 19.08.2011 06:40
Hilfe bundespolizei trojaner !!!
 
tag zusammen ich brauche dringend hilfe von euch profis :(

unzwar habe ich auf mein laptop ein miesen trojaner

wenn ich den rechner hochfahre kommt immer ein pop-up wo drin steht , das ich 100 euro bezahlen muss etc. da steht auch groß bundespolizei.

ich hab auch schon kaspersky rescue cd ausprobiert, ich hab das 3 mal durchscannen lassen aber da gabs immer 0 funde.

und jetzt geht irgendwie auch garnix mehr.

ich fahr den rechner hoch dan komme ich zu der einstellung windows normal starten , windows in abgesicherten modus starten, wenn ich da was drücke passiert nix und der rechner fährt wieder neu hoch.


brauche da dringend hilfe weil ich da nicht allzuviel ahnung habe.

wäre sehr dankbar wenn ihr mir helfen würdert :)


grüße :)

kira 19.08.2011 06:59
Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:
Zitat:
  • "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
    - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
    - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
  • Charakteristische Merkmale/Profilinformationen:
    - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du herauslöschen oder durch [X] ersetzen
  • Die Systemprüfung und Bereinigung:
    - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
  • Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
  • Innerhalb der Betreuungszeit:
    - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
  • Die Reihenfolge:
    - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
  • GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
  • Ansonsten unsere Forumsregeln:
    - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
  • Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen:)
Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

Unbootbares System mit OTLPE Network scannen

Unbootbares System mit OTLPE Network scannen
  • Lade OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop.
    Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
  • Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
  • Lege eine leere CD in Deinen Brenner.
  • ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
  • Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
  • Du kannst nun die Fenster des Brennprogramms schließen.
  • Starte das unbootbare System neu und boote von der CD, die Du gerade erstellt hast.
    Anmerkung: Wenn Du nicht weißt, wie Du Deinen Computer dazu bringst, von CD zu booten, dann folge diesen Schritten hier.
  • Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
  • Mache einen Doppelklick auf das OTLPE Icon.
  • Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
  • Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
  • Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
  • OTLpe sollte nun starten.

    http://image.hijackthis.de/upload/hjt1-034.jpg
  • Drücke Run Scan, um den Scan zu starten.
  • Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt gesichert und mit Notepad++ geöffnet.
  • Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
  • Bitte poste den Inhalt von C:\OTL.Txt und Extras.Txt in diesen Thread.
Falls Du kein Brennprogramm hast:

ISOBurner
Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen.
Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.

Zitat:
Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B hjtsanlist o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]
gruß
kira

kaitokito21 19.08.2011 16:57
danke schonmal das du mir helfen willst :)

also ich hab alles befolgt wie es da steht aber ich kriege nur die OTL.Txt datei

ich stell die mal rein :)

Code:
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 34.18 Gb Total Space | 0.53 Gb Free Space | 1.56% Space Free | Partition Type: NTFS
Drive E: | 263.91 Gb Total Space | 263.64 Gb Free Space | 99.90% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011/07/30 15:31:53 | 003,542,616 | ---- | M] () [Auto] -- C:/Program Files/Common Files/Akamai/netsession_win_2da1ebd.dll -- (Akamai)
SRV - [2011/07/23 08:24:24 | 000,269,480 | ---- | M] (Avira GmbH) [Disabled] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/04/21 01:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Disabled] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/06/21 11:47:04 | 000,246,584 | ---- | M] () [Auto] -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010/01/15 08:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2008/08/26 20:52:14 | 000,159,744 | ---- | M] () [Auto] -- C:\Program Files\System Control Manager\MSIService.exe -- (Micro Star SCM)
SRV - [2008/03/18 00:27:12 | 000,013,312 | ---- | M] (Agere Systems) [Auto] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2008/01/20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/09/28 20:05:16 | 000,128,360 | ---- | M] (TOSHIBA CORPORATION) [Auto] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (SymIMMP)
DRV - File not found [Kernel | On_Demand] --  -- (SymIM)
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand] --  -- (IpInIp)
DRV - File not found [Kernel | On_Demand] --  -- (EagleNT)
DRV - [2011/07/23 08:24:24 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/07/23 08:24:24 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/07/21 15:46:11 | 000,233,024 | ---- | M] (DT Soft Ltd) [Kernel | System] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2009/10/08 11:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008/09/24 00:26:00 | 007,585,920 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008/06/30 07:56:12 | 000,917,504 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008/06/09 04:45:08 | 001,748,352 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2008/05/02 01:59:40 | 000,122,368 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008/04/28 13:54:58 | 000,054,784 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\enecir.sys -- (enecir)
DRV - [2008/04/27 18:29:26 | 003,658,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)
DRV - [2008/03/21 00:13:00 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2008/02/15 19:01:06 | 000,131,712 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfbd.sys -- (tosrfbd)
DRV - [2008/01/31 19:55:06 | 000,074,240 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Tosrfhid.sys -- (Tosrfhid)
DRV - [2008/01/23 00:57:48 | 000,054,144 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\TosRfSnd.sys -- (TosRfSnd)
DRV - [2007/11/29 13:45:44 | 000,036,608 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfbnp.sys -- (tosrfbnp)
DRV - [2007/10/18 18:25:00 | 000,041,856 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfusb.sys -- (Tosrfusb)
DRV - [2007/10/02 15:43:22 | 000,064,128 | ---- | M] (TOSHIBA Corporation) [Kernel | System] -- C:\Windows\System32\drivers\tosrfcom.sys -- (Tosrfcom)
DRV - [2006/10/10 23:33:00 | 000,041,600 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosporte.sys -- (tosporte)
DRV - [2005/01/07 09:42:00 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfnds.sys -- (tosrfnds)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.msi.com.tw
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.)
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\Onkel_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.msi.com.tw
IE - HKU\Onkel_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1700389
IE - HKU\Onkel_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\Onkel_ON_C\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\Onkel_ON_C\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\Onkel_ON_C\..\URLSearchHook: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll (Conduit Ltd.)
IE - HKU\Onkel_ON_C\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\Onkel_ON_C\..\URLSearchHook: {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.)
IE - HKU\Onkel_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/07/22 15:03:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2011/07/22 19:03:56 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/07/22 19:03:56 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/07/08 03:31:38 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/01/01 04:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010/01/01 04:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011/08/14 07:59:18 | 000,000,143 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\foxsearch.src
[2010/01/01 04:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010/01/01 04:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2010/01/01 04:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (IsoBuster Toolbar) - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll (Conduit Ltd.)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (ClipGrab Toolbar) - {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (IsoBuster Toolbar) - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Onkel\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH)
O3 - HKLM\..\Toolbar: (ClipGrab Toolbar) - {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.)
O3 - HKU\Onkel_ON_C\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\Onkel_ON_C\..\Toolbar\WebBrowser: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Onkel\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH)
O3 - HKU\Onkel_ON_C\..\Toolbar\WebBrowser: (ClipGrab Toolbar) - {E36DF325-3F4B-476F-8F89-123BC5D51A30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ccApp]  File not found
O4 - HKLM..\Run: [isCfgWiz]  File not found
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)
O4 - HKLM..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe (Mirco-Star International  CO., LTD.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PSQLLauncher] C:\Program Files\Protector Suite QL\launcher.exe (UPEK Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\Onkel_ON_C..\Run: [avupdate] C:\Users\Onkel\AppData\Roaming\jashla.exe (Legion)
O4 - HKU\Onkel_ON_C..\Run: [DAEMON Tools Pro Agent] C:\Program Files\DAEMON Tools Pro\DTAgent.exe (DT Soft Ltd)
O4 - HKU\Onkel_ON_C..\Run: [ICQ] C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O4 - HKU\Onkel_ON_C..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O4 - HKU\Onkel_ON_C..\Run: [winlogon] C:\Users\Onkel\AppData\Roaming\logs\winlogon.exe ()
O4 - Startup: Error locating startup folders.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.26.0.cab (SysInfo Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\Windows\System32\vrlogon.dll (UPEK Inc.)
O20 - Winlogon\Notify\psfus: DllName - C:\Windows\system32\psqlpwd.dll - C:\Windows\System32\psqlpwd.dll (UPEK Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/08/16 15:04:31 | 000,000,000 | ---D | C] -- C:\Diablo IId
[2011/08/14 13:23:35 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\Setup1.exe
[2011/08/14 13:23:34 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE
[2011/08/14 10:47:16 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2011/08/14 08:06:26 | 000,000,000 | ---D | C] -- C:\Program Files\NCH Software
[2011/08/14 08:06:15 | 000,000,000 | ---D | C] -- C:\ProgramData\NCH Swift Sound
[2011/08/14 08:06:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite
[2011/08/14 08:06:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audio Related Programs
[2011/08/14 08:06:04 | 000,000,000 | ---D | C] -- C:\Program Files\NCH Swift Sound
[2011/08/14 07:59:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IsoBuster
[2011/08/14 07:59:26 | 000,000,000 | ---D | C] -- C:\Program Files\IsoBuster
[2011/08/14 07:59:25 | 000,000,000 | ---D | C] -- C:\Program Files\Smart Projects
[2011/08/14 07:59:14 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Gutscheinmieze
[2011/08/14 07:11:31 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Documents\Ulead Burn.Now
[2011/08/14 07:11:30 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Ulead Systems
[2011/08/13 05:56:53 | 000,000,000 | -HSD | C] -- C:\found.000
[2011/08/07 12:19:03 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Desktop\TXT
[2011/08/07 12:19:03 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Desktop\MPG
[2011/08/06 16:02:15 | 000,000,000 | ---D | C] -- C:\Awesom-O 5.0b3
[2011/08/03 16:20:42 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2011/08/01 21:34:39 | 000,192,000 | ---- | C] (Legion) -- C:\Users\Onkel\AppData\Roaming\jashla.exe
[2011/07/30 16:42:03 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\logs
[2011/07/30 16:35:39 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2011/07/30 16:11:28 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\alaplaya
[2011/07/30 16:11:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\alaplaya
[2011/07/30 16:11:06 | 000,000,000 | ---D | C] -- C:\Program Files\alaplaya
[2011/07/30 15:31:38 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Akamai
[2011/07/29 18:12:08 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Desktop\Diablo IId
[2011/07/24 18:17:22 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Local\PMB Files
[2011/07/24 18:17:21 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files
[2011/07/24 18:16:48 | 000,000,000 | ---D | C] -- C:\Program Files\Pando Networks
[2011/07/24 12:41:05 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
[2011/07/24 12:41:04 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Local\Conduit
[2011/07/24 12:40:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClipGrab
[2011/07/24 12:40:47 | 000,000,000 | ---D | C] -- C:\Program Files\ClipGrab
[2011/07/23 14:50:28 | 000,000,000 | ---D | C] -- C:\Program Files\SystemRequirementsLab
[2011/07/23 14:50:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2011/07/22 19:04:05 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Skype
[2011/07/22 19:03:52 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2011/07/22 19:03:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/07/22 19:03:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2011/07/22 15:04:10 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Local\Mozilla
[2011/07/22 15:03:52 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2011/07/22 13:59:19 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Documents\ICQ
[2011/07/22 13:38:37 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Avira
[2011/07/22 13:37:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011/07/22 13:37:25 | 000,138,192 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011/07/22 13:37:25 | 000,066,616 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011/07/22 13:37:25 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys
[2011/07/22 13:37:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2011/07/22 13:37:24 | 000,000,000 | ---D | C] -- C:\Program Files\Avira
[2011/07/22 10:10:46 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diablo II
[2011/07/22 10:02:35 | 000,102,400 | ---- | C] (Blizzard Entertainment) -- C:\Windows\DIIUnin.exe
[2011/07/21 15:46:11 | 000,233,024 | ---- | C] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys
[2011/07/21 15:46:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Pro
[2011/07/21 15:46:08 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Pro
[2011/07/21 15:46:02 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\DAEMON Tools Pro
[2011/07/21 15:46:02 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Pro
[2011/07/21 14:19:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo II
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011/08/17 10:51:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/08/17 10:51:46 | 3220,340,736 | -HS- | M] () -- C:\hiberfil.sys
[2011/08/16 15:40:42 | 000,000,680 | ---- | M] () -- C:\Users\Onkel\AppData\Local\d3d9caps.dat
[2011/08/16 15:12:25 | 000,000,593 | ---- | M] () -- C:\Users\Onkel\Desktop\Diablo II - Verknüpfung.lnk
[2011/08/16 15:05:45 | 000,627,756 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011/08/16 15:05:45 | 000,595,386 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/08/16 15:05:45 | 000,125,870 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011/08/16 15:05:45 | 000,103,460 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/08/16 10:50:59 | 000,450,560 | ---- | M] () -- C:\ProgramData\Onkel.jpg
[2011/08/16 10:50:03 | 000,042,559 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011/08/16 10:49:52 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/08/16 10:49:47 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/08/16 10:49:47 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/08/14 13:23:35 | 000,249,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\Setup1.exe
[2011/08/14 13:23:34 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE
[2011/08/14 11:55:37 | 000,001,275 | -H-- | M] () -- C:\Users\Onkel\AppData\Roaming\Inf468
[2011/08/14 11:53:49 | 000,000,618 | -H-- | M] () -- C:\Users\Onkel\AppData\Roaming\Inf002
[2011/08/14 11:53:46 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/08/14 11:53:09 | 000,042,559 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011/08/14 08:06:37 | 000,000,976 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Rip.lnk
[2011/08/14 08:06:37 | 000,000,964 | ---- | M] () -- C:\Users\Public\Desktop\Express Rip.lnk
[2011/08/14 08:06:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite
[2011/08/14 08:06:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audio Related Programs
[2011/08/14 08:06:26 | 000,000,945 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WavePad Sound Editor.lnk
[2011/08/14 08:06:26 | 000,000,933 | ---- | M] () -- C:\Users\Public\Desktop\WavePad Sound Editor.lnk
[2011/08/14 08:06:04 | 000,001,032 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Burn Disc Burning Software.lnk
[2011/08/14 08:06:04 | 000,001,020 | ---- | M] () -- C:\Users\Public\Desktop\Express Burn Disc Burning Software.lnk
[2011/08/14 08:02:09 | 208,970,042 | ---- | M] () -- C:\Users\Onkel\Documents\hgj.ixb
[2011/08/14 07:59:27 | 000,000,935 | ---- | M] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\IsoBuster.lnk
[2011/08/14 07:59:27 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IsoBuster
[2011/08/14 06:49:38 | 000,002,509 | ---- | M] () -- C:\Users\Public\Desktop\MSI BurnRecovery.lnk
[2011/08/13 05:53:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/08/10 16:41:49 | 000,016,384 | ---- | M] () -- C:\ProgramData\key3.db
[2011/08/06 16:28:19 | 000,000,057 | -H-- | M] () -- C:\ProgramData\Inf001
[2011/08/04 14:40:33 | 000,000,000 | R--D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
[2011/08/01 21:34:39 | 000,192,000 | ---- | M] (Legion) -- C:\Users\Onkel\AppData\Roaming\jashla.exe
[2011/08/01 09:26:37 | 000,387,135 | ---- | M] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe
[2011/07/30 21:53:49 | 000,218,631 | ---- | M] () -- C:\Users\Onkel\Documents\DSC01236.JPG
[2011/07/30 16:42:11 | 000,333,288 | ---- | M] () -- C:\Windows\System32\sqlite3.dll
[2011/07/30 16:11:28 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\alaplaya
[2011/07/29 18:22:46 | 000,026,895 | ---- | M] () -- C:\Windows\DIIUnin.dat
[2011/07/29 15:34:14 | 000,686,253 | ---- | M] () -- C:\Users\Onkel\Documents\DSC08338.JPG
[2011/07/29 14:59:13 | 000,838,465 | ---- | M] () -- C:\Users\Onkel\Documents\DSC08341.JPG
[2011/07/29 14:55:25 | 000,157,227 | ---- | M] () -- C:\Users\Onkel\Documents\DSC01247.JPG
[2011/07/29 14:55:19 | 000,116,645 | ---- | M] () -- C:\Users\Onkel\Documents\DSC01245.JPG
[2011/07/27 09:40:43 | 002,358,894 | ---- | M] () -- C:\Users\Onkel\Documents\09052011129.jpg
[2011/07/27 09:40:22 | 001,497,447 | ---- | M] () -- C:\Users\Onkel\Documents\09052011117.jpg
[2011/07/24 17:54:43 | 000,000,948 | ---- | M] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/07/24 17:49:15 | 002,574,324 | ---- | M] () -- C:\Users\Onkel\Documents\bitch.JPG
[2011/07/24 17:42:31 | 001,981,420 | ---- | M] () -- C:\Users\Onkel\Documents\P7180756.JPG
[2011/07/24 13:09:35 | 001,794,999 | ---- | M] () -- C:\Users\Onkel\Documents\IMG_2551.JPG
[2011/07/24 13:07:59 | 000,199,596 | ---- | M] () -- C:\Users\Onkel\Documents\session esther 040.jpg
[2011/07/24 12:45:08 | 006,768,008 | ---- | M] () -- C:\Users\Onkel\Documents\DJ Antoine - Broadway 2011 (Radio Edit).mp3
[2011/07/24 12:40:51 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClipGrab
[2011/07/23 14:50:16 | 000,001,719 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
[2011/07/23 14:50:16 | 000,001,717 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/07/23 14:50:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2011/07/23 08:24:24 | 000,138,192 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011/07/23 08:24:24 | 000,066,616 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011/07/22 19:03:52 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/07/22 15:04:16 | 000,294,912 | ---- | M] () -- C:\ProgramData\signons.sqlite
[2011/07/22 15:03:53 | 000,000,880 | ---- | M] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/07/22 15:03:53 | 000,000,868 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/07/22 15:03:53 | 000,000,856 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/07/22 13:37:29 | 000,001,857 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2011/07/22 13:37:29 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2011/07/22 10:11:40 | 002,108,703 | ---- | M] () -- C:\patch_d2.mpq
[2011/07/22 10:10:56 | 000,021,840 | ---- | M] () -- C:\Windows\System32\SIntfNT.dll
[2011/07/22 10:10:56 | 000,017,212 | ---- | M] () -- C:\Windows\System32\SIntf32.dll
[2011/07/22 10:10:56 | 000,012,067 | ---- | M] () -- C:\Windows\System32\SIntf16.dll
[2011/07/22 10:02:35 | 000,102,400 | ---- | M] (Blizzard Entertainment) -- C:\Windows\DIIUnin.exe
[2011/07/22 10:02:35 | 000,002,829 | ---- | M] () -- C:\Windows\DIIUnin.pif
[2011/07/22 10:02:35 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo II
[2011/07/21 17:42:19 | 000,000,226 | ---- | M] () -- C:\Users\Onkel\Documents\Dokument.rtf
[2011/07/21 17:09:46 | 000,043,520 | ---- | M] () -- C:\Windows\System32\CmdLineExt03.dll
[2011/07/21 15:46:43 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Pro
[2011/07/21 15:46:11 | 000,233,024 | ---- | M] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011/08/17 10:51:46 | 3220,340,736 | -HS- | C] () -- C:\hiberfil.sys
[2011/08/16 10:50:21 | 000,450,560 | ---- | C] () -- C:\ProgramData\Onkel.jpg
[2011/08/16 10:50:19 | 000,294,912 | ---- | C] () -- C:\ProgramData\signons.sqlite
[2011/08/16 10:50:19 | 000,016,384 | ---- | C] () -- C:\ProgramData\key3.db
[2011/08/14 08:06:37 | 000,000,976 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Rip.lnk
[2011/08/14 08:06:37 | 000,000,964 | ---- | C] () -- C:\Users\Public\Desktop\Express Rip.lnk
[2011/08/14 08:06:26 | 000,000,945 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WavePad Sound Editor.lnk
[2011/08/14 08:06:26 | 000,000,933 | ---- | C] () -- C:\Users\Public\Desktop\WavePad Sound Editor.lnk
[2011/08/14 08:06:04 | 000,001,032 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Burn Disc Burning Software.lnk
[2011/08/14 08:06:04 | 000,001,020 | ---- | C] () -- C:\Users\Public\Desktop\Express Burn Disc Burning Software.lnk
[2011/08/14 08:02:07 | 208,970,042 | ---- | C] () -- C:\Users\Onkel\Documents\hgj.ixb
[2011/08/14 07:59:27 | 000,000,935 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\IsoBuster.lnk
[2011/08/08 12:33:50 | 000,001,275 | -H-- | C] () -- C:\Users\Onkel\AppData\Roaming\Inf468
[2011/08/08 12:33:50 | 000,000,618 | -H-- | C] () -- C:\Users\Onkel\AppData\Roaming\Inf002
[2011/08/07 12:21:41 | 002,108,703 | ---- | C] () -- C:\patch_d2.mpq
[2011/08/06 16:15:08 | 000,387,135 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe
[2011/08/06 16:15:08 | 000,000,057 | -H-- | C] () -- C:\ProgramData\Inf001
[2011/08/04 14:58:43 | 000,000,680 | ---- | C] () -- C:\Users\Onkel\AppData\Local\d3d9caps.dat
[2011/08/04 14:40:33 | 000,001,717 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/08/04 14:40:33 | 000,001,167 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
[2011/08/04 14:40:33 | 000,000,821 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
[2011/07/30 21:53:36 | 000,218,631 | ---- | C] () -- C:\Users\Onkel\Documents\DSC01236.JPG
[2011/07/30 16:42:04 | 000,333,288 | ---- | C] () -- C:\Windows\System32\sqlite3.dll
[2011/07/29 19:17:12 | 000,000,593 | ---- | C] () -- C:\Users\Onkel\Desktop\Diablo II - Verknüpfung.lnk
[2011/07/29 15:34:08 | 000,686,253 | ---- | C] () -- C:\Users\Onkel\Documents\DSC08338.JPG
[2011/07/29 14:59:05 | 000,838,465 | ---- | C] () -- C:\Users\Onkel\Documents\DSC08341.JPG
[2011/07/29 14:55:23 | 000,157,227 | ---- | C] () -- C:\Users\Onkel\Documents\DSC01247.JPG
[2011/07/29 14:55:18 | 000,116,645 | ---- | C] () -- C:\Users\Onkel\Documents\DSC01245.JPG
[2011/07/27 09:40:11 | 002,358,894 | ---- | C] () -- C:\Users\Onkel\Documents\09052011129.jpg
[2011/07/27 09:40:08 | 001,497,447 | ---- | C] () -- C:\Users\Onkel\Documents\09052011117.jpg
[2011/07/24 17:54:43 | 000,000,948 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/07/24 17:48:41 | 002,574,324 | ---- | C] () -- C:\Users\Onkel\Documents\bitch.JPG
[2011/07/24 17:42:11 | 001,981,420 | ---- | C] () -- C:\Users\Onkel\Documents\P7180756.JPG
[2011/07/24 13:09:19 | 001,794,999 | ---- | C] () -- C:\Users\Onkel\Documents\IMG_2551.JPG
[2011/07/24 13:07:56 | 000,199,596 | ---- | C] () -- C:\Users\Onkel\Documents\session esther 040.jpg
[2011/07/24 12:44:52 | 006,768,008 | ---- | C] () -- C:\Users\Onkel\Documents\DJ Antoine - Broadway 2011 (Radio Edit).mp3
[2011/07/22 15:03:53 | 000,000,880 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/07/22 15:03:53 | 000,000,868 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011/07/22 15:03:53 | 000,000,856 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/07/22 13:37:29 | 000,001,857 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk
[2011/07/22 10:02:38 | 000,026,895 | ---- | C] () -- C:\Windows\DIIUnin.dat
[2011/07/22 10:02:35 | 000,002,829 | ---- | C] () -- C:\Windows\DIIUnin.pif
[2011/07/21 17:42:19 | 000,000,226 | ---- | C] () -- C:\Users\Onkel\Documents\Dokument.rtf
[2011/07/21 15:56:32 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2011/07/21 14:33:02 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2011/07/21 14:33:02 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2011/07/21 14:33:02 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2011/06/02 08:59:31 | 000,003,584 | ---- | C] () -- C:\Users\Onkel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/19 11:44:26 | 000,840,580 | ---- | C] () -- C:\ProgramData\LuUninstall.LiveUpdate
[2008/12/23 09:45:59 | 000,000,000 | ---- | C] () -- C:\Windows\tosOBEX.INI
[2008/12/22 17:27:19 | 001,748,352 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2008/12/22 17:27:19 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2008/12/22 17:16:37 | 000,042,559 | ---- | C] () -- C:\ProgramData\nvModes.001
[2008/12/22 17:10:52 | 000,042,559 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2008/12/22 16:21:02 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2008/12/22 16:21:02 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/12/22 15:29:15 | 000,627,756 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008/12/22 15:29:15 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008/12/22 15:29:15 | 000,125,870 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008/12/22 15:29:15 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2007/12/21 20:46:32 | 000,118,784 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll
[2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 000,265,896 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,595,386 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,103,460 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2005/07/23 01:30:18 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll
 
========== LOP Check ==========
 
[2011/07/21 15:47:14 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\DAEMON Tools Pro
[2011/08/14 07:59:18 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\Gutscheinmieze
[2011/08/17 00:12:04 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\ICQ
[2011/07/30 16:57:00 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\logs
[2010/06/19 11:36:54 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\Protector Suite
[2011/08/14 07:11:30 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\Ulead Systems
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2011/07/20 14:26:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Ask
[2011/07/21 15:46:06 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Pro
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2011/05/02 11:02:49 | 000,000,000 | ---D | M] -- C:\ProgramData\ICQ
[2011/08/14 08:06:15 | 000,000,000 | ---D | M] -- C:\ProgramData\NCH Swift Sound
[2011/07/24 18:18:10 | 000,000,000 | ---D | M] -- C:\ProgramData\PMB Files
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2011/07/31 15:33:58 | 000,000,000 | ---D | M] -- C:\ProgramData\TEMP
[2006/11/02 09:02:04 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2008/12/22 17:20:22 | 000,000,000 | ---D | M] -- C:\ProgramData\UIB
[2011/08/14 07:11:29 | 000,000,000 | ---D | M] -- C:\ProgramData\Ulead Systems
[2011/08/04 14:43:50 | 000,032,636 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:F63A059B
< End of report >

kira 20.08.2011 05:38
1.
Fixen mit OTL
  • Starte die OTL.exe.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Kopiere folgendes Skript:
Code:
:OTL
SRV - [2010/01/15 08:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.)
IE - HKU\Onkel_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1700389
IE - HKU\Onkel_ON_C\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKU\Onkel_ON_C\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\Onkel_ON_C\..\URLSearchHook: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll (Conduit Ltd.)
IE - HKU\Onkel_ON_C\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
[2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2010/01/01 04:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
O2 - BHO: (IsoBuster Toolbar) - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll (Conduit Ltd.)
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (ClipGrab Toolbar) - {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (IsoBuster Toolbar) - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Onkel\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH)
O3 - HKLM\..\Toolbar: (ClipGrab Toolbar) - {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.)
O3 - HKU\Onkel_ON_C\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKU\Onkel_ON_C\..\Toolbar\WebBrowser: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Onkel\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH)
O3 - HKU\Onkel_ON_C\..\Toolbar\WebBrowser: (ClipGrab Toolbar) - {E36DF325-3F4B-476F-8F89-123BC5D51A30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [ccApp]  File not found
O4 - HKLM..\Run: [isCfgWiz]  File not found
O4 - HKU\Onkel_ON_C..\Run: [avupdate] C:\Users\Onkel\AppData\Roaming\jashla.exe (Legion)
O4 - HKU\Onkel_ON_C..\Run: [winlogon] C:\Users\Onkel\AppData\Roaming\logs\winlogon.exe ()
[2011/08/01 21:34:39 | 000,192,000 | ---- | C] (Legion) -- C:\Users\Onkel\AppData\Roaming\jashla.exe
[2011/07/24 12:41:04 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Local\Conduit
[2011/07/20 14:26:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Ask
@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:F63A059B

:Commands
[purity]
[emptytemp]

** kannst Du wieder normal starten?

2.
erneut einen Scan mit OTL:
  • Doppelklick auf die OTL.exe
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Oben findest Du ein Kästchen mit Ausgabe.
    Wähle bitte Standard-Ausgabe
  • Unter Extra-Registrierung wähle bitte Benutze SafeList.
  • Mache Häckchen bei LOP- und Purity-Prüfung.
  • Klicke nun auf Scan links oben.
  • Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
    Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.

kaitokito21 20.08.2011 10:38
Da gibt es ein problem,
ich hab die OTL.exe auf mein Desktop gezogen und Doppelklick drauf aber da passiert nichts.


und wenn ich als Adminstrator Starten will steht da nur:

B:\Documents and Settings\Default User\Desktop\OTL.exe

The specified service does not exist as an installed service.

kira 21.08.2011 05:46
Zitat:
Zitat von kaitokito21 (Beitrag 695033)
Da gibt es ein problem,
ich hab die OTL.exe auf mein Desktop gezogen
das verstehe nicht ganz? Du hast schon auf dem Desktop gehabt (Posting #4)
Anleitung nochmal lesen:-> http://www.trojaner-board.de/102696-...tml#post694737

kaitokito21 21.08.2011 10:17
verzeihung habe da was falsch gemacht aber jetzt hat alles geklappt.

ich stell mal die ganzen logs hier rein :)

Das ist vom Fix scan

Code:
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\McComponentHostService deleted successfully.
C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}\ deleted successfully.
C:\Program Files\IsoBuster\tbIsoB.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.
C:\Program Files\ICQ6Toolbar\ICQToolBar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{e36df325-3f4b-476f-8f89-123bc5d51a30} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e36df325-3f4b-476f-8f89-123bc5d51a30}\ deleted successfully.
C:\Program Files\ClipGrab\prxtbClip.dll moved successfully.
HKU\Onkel_ON_C\Software\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ deleted successfully.
C:\Program Files\Ask.com\GenericAskToolbar.dll moved successfully.
Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks\\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}\ not found.
File C:\Program Files\IsoBuster\tbIsoB.dll not found.
Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.
File C:\Program Files\ICQ6Toolbar\ICQToolBar.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
File C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
File C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) not found.
C:\Program Files\Mozilla Firefox\searchplugins\bing.xml moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}\ not found.
File C:\Program Files\IsoBuster\tbIsoB.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ deleted successfully.
C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e36df325-3f4b-476f-8f89-123bc5d51a30}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e36df325-3f4b-476f-8f89-123bc5d51a30}\ not found.
File C:\Program Files\ClipGrab\prxtbClip.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}\ not found.
File C:\Program Files\IsoBuster\tbIsoB.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found.
File C:\Program Files\ICQ6Toolbar\ICQToolBar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27}\ deleted successfully.
C:\Users\Onkel\AppData\Roaming\Gutscheinmieze\toolbar.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{e36df325-3f4b-476f-8f89-123bc5d51a30} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e36df325-3f4b-476f-8f89-123bc5d51a30}\ not found.
File C:\Program Files\ClipGrab\prxtbClip.dll not found.
Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27}\ not found.
File C:\Users\Onkel\AppData\Roaming\Gutscheinmieze\toolbar.dll not found.
Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E36DF325-3F4B-476F-8F89-123BC5D51A30} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E36DF325-3F4B-476F-8F89-123BC5D51A30}\ not found.
File C:\Program Files\ClipGrab\prxtbClip.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully.
C:\Program Files\Ask.com\Updater\Updater.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ccApp deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\isCfgWiz deleted successfully.
Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\avupdate deleted successfully.
C:\Users\Onkel\AppData\Roaming\jashla.exe moved successfully.
Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\winlogon deleted successfully.
C:\Users\Onkel\AppData\Roaming\logs\winlogon.exe moved successfully.
File C:\Users\Onkel\AppData\Roaming\jashla.exe not found.
C:\Users\Onkel\AppData\Local\Conduit\CT2536373 folder moved successfully.
C:\Users\Onkel\AppData\Local\Conduit folder moved successfully.
C:\ProgramData\Ask\APN-Stub folder moved successfully.
C:\ProgramData\Ask folder moved successfully.
ADS C:\ProgramData\TEMP:F63A059B deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 6 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 49562878 bytes
 
Total Files Cleaned = 47.00 mb
 
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 08212011_135315


jetzt die Extras.txt

Code:
OTL Extras logfile created on: 8/21/2011 3:05:41 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
Windows Vista (TM) Home Premium Service Pack 1 (Version = 6.0.6001) - Type = System
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 34.18 Gb Total Space | 0.57 Gb Free Space | 1.66% Space Free | Partition Type: NTFS
Drive E: | 263.91 Gb Total Space | 263.64 Gb Free Space | 99.90% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07690F1C-04B1-4060-9691-6748ED1826B9}" = MSI Software Install
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F77C418-2C90-459C-BD33-B56A4182B9FA}" = System Requirements Lab CYRI
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23B14BE4-5277-40B2-B602-3FCD456C27BC}" = Protector Suite QL 5.8
"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 26
"{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}" = BurnRecovery
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{87725CEF-1BC6-47C5-B2CD-96DD6D392EE3}" = Dolby Control Center
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver
"{8A1033B0-EF33-4FB5-97A1-C47A7DCDD7E6}_is1" = ClipGrab 3.1.0.1
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-040C-0000-0000000FF1CE}" = Microsoft Office Excel MUI (French) 2007
"{90120000-0016-0410-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Italian) 2007
"{90120000-0016-0C0A-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Spanish) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (French) 2007
"{90120000-0018-0410-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Italian) 2007
"{90120000-0018-0C0A-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Spanish) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-040C-0000-0000000FF1CE}" = Microsoft Office Word MUI (French) 2007
"{90120000-001B-0410-0000-0000000FF1CE}" = Microsoft Office Word MUI (Italian) 2007
"{90120000-001B-0C0A-0000-0000000FF1CE}" = Microsoft Office Word MUI (Spanish) 2007
"{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007
"{90120000-001F-0403-0000-0000000FF1CE}" = Microsoft Office Proof (Catalan) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007
"{90120000-001F-0416-0000-0000000FF1CE}" = Microsoft Office Proof (Portuguese (Brazil)) 2007
"{90120000-001F-042D-0000-0000000FF1CE}" = Microsoft Office Proof (Basque) 2007
"{90120000-001F-0456-0000-0000000FF1CE}" = Microsoft Office Proof (Galician) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-002C-040C-0000-0000000FF1CE}" = Microsoft Office Proofing (French) 2007
"{90120000-002C-0410-0000-0000000FF1CE}" = Microsoft Office Proofing (Italian) 2007
"{90120000-002C-0C0A-0000-0000000FF1CE}" = Microsoft Office Proofing (Spanish) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-040C-0000-0000000FF1CE}" = Microsoft Office Shared MUI (French) 2007
"{90120000-006E-0410-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Italian) 2007
"{90120000-006E-0C0A-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Spanish) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-040C-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (French) 2007
"{90120000-00A1-0410-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Italian) 2007
"{90120000-00A1-0C0A-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Spanish) 2007
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{A3BE3F1E-2472-4211-8735-E8239BE49D9F}" = Ulead Burn.Now 4.5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
"{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant
"{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}" = System Control Manager
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"5D38134BF8A10D640B30E6B014EECDBC5F881E3D" = Windows Driver Package - ENE (enecir) HIDClass  (04/29/2008 2.5.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Akamai" = Akamai NetSession Interface
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"ClipGrab Toolbar" = ClipGrab Toolbar
"DAEMON Tools Pro" = DAEMON Tools Pro
"Diablo II" = Diablo II
"ExpressBurn" = Express Burn Disc Burning Software
"ExpressRip" = Express Rip
"FantasyTennis" = FantasyTennis
"Gutscheinmieze - Toolbar" = Gutscheinmieze - Toolbar
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ICQToolbar" = ICQ Toolbar
"InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}" = Ulead Burn.Now 4.5 SE
"IsoBuster Toolbar" = IsoBuster Toolbar
"IsoBuster_is1" = IsoBuster 2.8
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 5.0.1 (x86 de)" = Mozilla Firefox 5.0.1 (x86 de)
"NVIDIA Drivers" = NVIDIA Drivers
"WavePad" = WavePad Sound Editor
"WinRAR archiver" = WinRAR archiver
 
< End of report >



Und jetzt OTL.Txt

Code:
OTL logfile created on: 8/21/2011 3:05:41 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
Windows Vista (TM) Home Premium Service Pack 1 (Version = 6.0.6001) - Type = System
Internet Explorer (Version = 8.0.6001.19088)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 34.18 Gb Total Space | 0.57 Gb Free Space | 1.66% Space Free | Partition Type: NTFS
Drive E: | 263.91 Gb Total Space | 263.64 Gb Free Space | 99.90% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011/07/30 15:31:53 | 003,542,616 | ---- | M] () [Auto] -- C:/Program Files/Common Files/Akamai/netsession_win_2da1ebd.dll -- (Akamai)
SRV - [2011/07/23 08:24:24 | 000,269,480 | ---- | M] (Avira GmbH) [Disabled] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/04/21 01:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Disabled] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/06/21 11:47:04 | 000,246,584 | ---- | M] () [Auto] -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2008/08/26 20:52:14 | 000,159,744 | ---- | M] () [Auto] -- C:\Program Files\System Control Manager\MSIService.exe -- (Micro Star SCM)
SRV - [2008/03/18 00:27:12 | 000,013,312 | ---- | M] (Agere Systems) [Auto] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2008/01/20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/09/28 20:05:16 | 000,128,360 | ---- | M] (TOSHIBA CORPORATION) [Auto] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (SymIMMP)
DRV - File not found [Kernel | On_Demand] --  -- (SymIM)
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand] --  -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand] --  -- (IpInIp)
DRV - File not found [Kernel | On_Demand] --  -- (EagleNT)
DRV - [2011/07/23 08:24:24 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/07/23 08:24:24 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2011/07/21 15:46:11 | 000,233,024 | ---- | M] (DT Soft Ltd) [Kernel | System] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2009/10/08 11:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008/09/24 00:26:00 | 007,585,920 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2008/06/30 07:56:12 | 000,917,504 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2008/06/09 04:45:08 | 001,748,352 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2008/05/02 01:59:40 | 000,122,368 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008/04/28 13:54:58 | 000,054,784 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\enecir.sys -- (enecir)
DRV - [2008/04/27 18:29:26 | 003,658,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)
DRV - [2008/03/21 00:13:00 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2008/02/15 19:01:06 | 000,131,712 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfbd.sys -- (tosrfbd)
DRV - [2008/01/31 19:55:06 | 000,074,240 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Tosrfhid.sys -- (Tosrfhid)
DRV - [2008/01/23 00:57:48 | 000,054,144 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\TosRfSnd.sys -- (TosRfSnd)
DRV - [2007/11/29 13:45:44 | 000,036,608 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfbnp.sys -- (tosrfbnp)
DRV - [2007/10/18 18:25:00 | 000,041,856 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfusb.sys -- (Tosrfusb)
DRV - [2007/10/02 15:43:22 | 000,064,128 | ---- | M] (TOSHIBA Corporation) [Kernel | System] -- C:\Windows\System32\drivers\tosrfcom.sys -- (Tosrfcom)
DRV - [2006/10/10 23:33:00 | 000,041,600 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosporte.sys -- (tosporte)
DRV - [2005/01/07 09:42:00 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfnds.sys -- (tosrfnds)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.msi.com.tw
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\Onkel_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.msi.com.tw
IE - HKU\Onkel_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page =
IE - HKU\Onkel_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\Onkel_ON_C\..\URLSearchHook: {e36df325-3f4b-476f-8f89-123bc5d51a30} - Reg Error: Key error. File not found
IE - HKU\Onkel_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/07/22 15:03:52 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2011/07/22 19:03:56 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/07/22 19:03:56 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011/07/08 03:31:38 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2010/01/01 04:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010/01/01 04:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011/08/14 07:59:18 | 000,000,143 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\foxsearch.src
[2010/01/01 04:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2010/01/01 04:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
 
O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION)
O4 - HKLM..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe (Mirco-Star International  CO., LTD.)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PSQLLauncher] C:\Program Files\Protector Suite QL\launcher.exe (UPEK Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\Onkel_ON_C..\Run: [DAEMON Tools Pro Agent] C:\Program Files\DAEMON Tools Pro\DTAgent.exe (DT Soft Ltd)
O4 - HKU\Onkel_ON_C..\Run: [ICQ] C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O4 - HKU\Onkel_ON_C..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O4 - Startup: Error locating startup folders.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.26.0.cab (SysInfo Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\Windows\System32\vrlogon.dll (UPEK Inc.)
O20 - Winlogon\Notify\psfus: DllName - C:\Windows\system32\psqlpwd.dll - C:\Windows\System32\psqlpwd.dll (UPEK Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/08/21 13:49:47 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/08/20 19:36:41 | 000,174,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\framedyn.dll
[2011/08/20 19:36:10 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Windows\OTL.exe
[2011/08/20 18:12:02 | 000,174,592 | ---- | C] (Microsoft Corporation) -- C:\framedyn.dll
[2011/08/20 18:11:44 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\OTL.exe
[2011/08/16 15:04:31 | 000,000,000 | ---D | C] -- C:\Diablo IId
[2011/08/14 13:23:35 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\Setup1.exe
[2011/08/14 13:23:34 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE
[2011/08/14 10:47:16 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2011/08/14 08:06:26 | 000,000,000 | ---D | C] -- C:\Program Files\NCH Software
[2011/08/14 08:06:15 | 000,000,000 | ---D | C] -- C:\ProgramData\NCH Swift Sound
[2011/08/14 08:06:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite
[2011/08/14 08:06:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audio Related Programs
[2011/08/14 08:06:04 | 000,000,000 | ---D | C] -- C:\Program Files\NCH Swift Sound
[2011/08/14 07:59:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IsoBuster
[2011/08/14 07:59:26 | 000,000,000 | ---D | C] -- C:\Program Files\IsoBuster
[2011/08/14 07:59:25 | 000,000,000 | ---D | C] -- C:\Program Files\Smart Projects
[2011/08/14 07:59:14 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Gutscheinmieze
[2011/08/14 07:11:31 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Documents\Ulead Burn.Now
[2011/08/14 07:11:30 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Ulead Systems
[2011/08/13 05:56:53 | 000,000,000 | -HSD | C] -- C:\found.000
[2011/08/07 12:19:03 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Desktop\TXT
[2011/08/07 12:19:03 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Desktop\MPG
[2011/08/06 16:02:15 | 000,000,000 | ---D | C] -- C:\Awesom-O 5.0b3
[2011/08/03 16:20:42 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2011/07/30 16:42:03 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\logs
[2011/07/30 16:35:39 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2011/07/30 16:11:28 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\alaplaya
[2011/07/30 16:11:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\alaplaya
[2011/07/30 16:11:06 | 000,000,000 | ---D | C] -- C:\Program Files\alaplaya
[2011/07/30 15:31:38 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Akamai
[2011/07/29 18:12:08 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Desktop\Diablo IId
[2011/07/24 18:17:22 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Local\PMB Files
[2011/07/24 18:17:21 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files
[2011/07/24 18:16:48 | 000,000,000 | ---D | C] -- C:\Program Files\Pando Networks
[2011/07/24 12:41:05 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
[2011/07/24 12:40:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClipGrab
[2011/07/24 12:40:47 | 000,000,000 | ---D | C] -- C:\Program Files\ClipGrab
[2011/07/23 14:50:28 | 000,000,000 | ---D | C] -- C:\Program Files\SystemRequirementsLab
[2011/07/23 14:50:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2011/07/22 19:04:05 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Skype
[2011/07/22 19:03:52 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2011/07/22 19:03:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011/07/22 19:03:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
 
========== Files - Modified Within 30 Days ==========
 
[2011/08/21 07:57:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/08/21 07:57:14 | 000,122,880 | ---- | M] () -- C:\ProgramData\Onkel.jpg
[2011/08/21 07:57:07 | 000,042,559 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011/08/21 07:57:03 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/08/21 07:57:03 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/08/21 07:56:58 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/08/21 07:56:49 | 3220,340,736 | -HS- | M] () -- C:\hiberfil.sys
[2011/08/20 19:36:15 | 000,000,462 | ---- | M] () -- C:\Windows\OTL.exe.lnk
[2011/08/20 18:12:25 | 000,000,380 | ---- | M] () -- C:\OTL.exe.lnk
[2011/08/16 15:40:42 | 000,000,680 | ---- | M] () -- C:\Users\Onkel\AppData\Local\d3d9caps.dat
[2011/08/16 15:12:25 | 000,000,593 | ---- | M] () -- C:\Users\Onkel\Desktop\Diablo II - Verknüpfung.lnk
[2011/08/16 15:05:45 | 000,627,756 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011/08/16 15:05:45 | 000,595,386 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/08/16 15:05:45 | 000,125,870 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011/08/16 15:05:45 | 000,103,460 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/08/14 13:23:35 | 000,249,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\Setup1.exe
[2011/08/14 13:23:34 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE
[2011/08/14 11:55:37 | 000,001,275 | -H-- | M] () -- C:\Users\Onkel\AppData\Roaming\Inf468
[2011/08/14 11:53:49 | 000,000,618 | -H-- | M] () -- C:\Users\Onkel\AppData\Roaming\Inf002
[2011/08/14 11:53:46 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/08/14 11:53:09 | 000,042,559 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011/08/14 08:06:37 | 000,000,976 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Rip.lnk
[2011/08/14 08:06:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite
[2011/08/14 08:06:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audio Related Programs
[2011/08/14 08:06:26 | 000,000,945 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WavePad Sound Editor.lnk
[2011/08/14 08:06:04 | 000,001,032 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Burn Disc Burning Software.lnk
[2011/08/14 08:02:09 | 208,970,042 | ---- | M] () -- C:\Users\Onkel\Documents\hgj.ixb
[2011/08/14 07:59:27 | 000,000,935 | ---- | M] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\IsoBuster.lnk
[2011/08/14 07:59:27 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IsoBuster
[2011/08/13 05:53:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/08/10 16:41:49 | 000,016,384 | ---- | M] () -- C:\ProgramData\key3.db
[2011/08/06 16:28:19 | 000,000,057 | -H-- | M] () -- C:\ProgramData\Inf001
[2011/08/04 14:40:33 | 000,000,000 | R--D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
[2011/08/01 09:26:37 | 000,387,135 | ---- | M] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe
[2011/07/30 21:53:49 | 000,218,631 | ---- | M] () -- C:\Users\Onkel\Documents\DSC01236.JPG
[2011/07/30 16:42:11 | 000,333,288 | ---- | M] () -- C:\Windows\System32\sqlite3.dll
[2011/07/30 16:11:28 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\alaplaya
[2011/07/29 18:22:46 | 000,026,895 | ---- | M] () -- C:\Windows\DIIUnin.dat
[2011/07/29 15:34:14 | 000,686,253 | ---- | M] () -- C:\Users\Onkel\Documents\DSC08338.JPG
[2011/07/29 14:59:13 | 000,838,465 | ---- | M] () -- C:\Users\Onkel\Documents\DSC08341.JPG
[2011/07/29 14:55:25 | 000,157,227 | ---- | M] () -- C:\Users\Onkel\Documents\DSC01247.JPG
[2011/07/29 14:55:19 | 000,116,645 | ---- | M] () -- C:\Users\Onkel\Documents\DSC01245.JPG
[2011/07/27 09:40:43 | 002,358,894 | ---- | M] () -- C:\Users\Onkel\Documents\09052011129.jpg
[2011/07/27 09:40:22 | 001,497,447 | ---- | M] () -- C:\Users\Onkel\Documents\09052011117.jpg
[2011/07/24 17:54:43 | 000,000,948 | ---- | M] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/07/24 17:49:15 | 002,574,324 | ---- | M] () -- C:\Users\Onkel\Documents\bitch.JPG
[2011/07/24 17:42:31 | 001,981,420 | ---- | M] () -- C:\Users\Onkel\Documents\P7180756.JPG
[2011/07/24 13:09:35 | 001,794,999 | ---- | M] () -- C:\Users\Onkel\Documents\IMG_2551.JPG
[2011/07/24 13:07:59 | 000,199,596 | ---- | M] () -- C:\Users\Onkel\Documents\session esther 040.jpg
[2011/07/24 12:45:08 | 006,768,008 | ---- | M] () -- C:\Users\Onkel\Documents\DJ Antoine - Broadway 2011 (Radio Edit).mp3
[2011/07/24 12:40:51 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClipGrab
[2011/07/23 14:50:16 | 000,001,717 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/07/23 14:50:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
[2011/07/23 08:24:24 | 000,138,192 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys
[2011/07/23 08:24:24 | 000,066,616 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys
[2011/07/22 19:03:52 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
 
========== Files Created - No Company Name ==========
 
[2011/08/20 19:36:15 | 000,000,462 | ---- | C] () -- C:\Windows\OTL.exe.lnk
[2011/08/20 18:12:25 | 000,000,380 | ---- | C] () -- C:\OTL.exe.lnk
[2011/08/17 10:51:46 | 3220,340,736 | -HS- | C] () -- C:\hiberfil.sys
[2011/08/16 10:50:21 | 000,122,880 | ---- | C] () -- C:\ProgramData\Onkel.jpg
[2011/08/16 10:50:19 | 000,294,912 | ---- | C] () -- C:\ProgramData\signons.sqlite
[2011/08/16 10:50:19 | 000,016,384 | ---- | C] () -- C:\ProgramData\key3.db
[2011/08/14 08:06:37 | 000,000,976 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Rip.lnk
[2011/08/14 08:06:26 | 000,000,945 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WavePad Sound Editor.lnk
[2011/08/14 08:06:04 | 000,001,032 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Burn Disc Burning Software.lnk
[2011/08/14 08:02:07 | 208,970,042 | ---- | C] () -- C:\Users\Onkel\Documents\hgj.ixb
[2011/08/14 07:59:27 | 000,000,935 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\IsoBuster.lnk
[2011/08/08 12:33:50 | 000,001,275 | -H-- | C] () -- C:\Users\Onkel\AppData\Roaming\Inf468
[2011/08/08 12:33:50 | 000,000,618 | -H-- | C] () -- C:\Users\Onkel\AppData\Roaming\Inf002
[2011/08/07 12:21:41 | 002,108,703 | ---- | C] () -- C:\patch_d2.mpq
[2011/08/06 16:15:08 | 000,387,135 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe
[2011/08/06 16:15:08 | 000,000,057 | -H-- | C] () -- C:\ProgramData\Inf001
[2011/08/04 14:58:43 | 000,000,680 | ---- | C] () -- C:\Users\Onkel\AppData\Local\d3d9caps.dat
[2011/08/04 14:40:33 | 000,001,717 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
[2011/08/04 14:40:33 | 000,001,167 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
[2011/08/04 14:40:33 | 000,000,821 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
[2011/07/30 21:53:36 | 000,218,631 | ---- | C] () -- C:\Users\Onkel\Documents\DSC01236.JPG
[2011/07/30 16:42:04 | 000,333,288 | ---- | C] () -- C:\Windows\System32\sqlite3.dll
[2011/07/29 19:17:12 | 000,000,593 | ---- | C] () -- C:\Users\Onkel\Desktop\Diablo II - Verknüpfung.lnk
[2011/07/29 15:34:08 | 000,686,253 | ---- | C] () -- C:\Users\Onkel\Documents\DSC08338.JPG
[2011/07/29 14:59:05 | 000,838,465 | ---- | C] () -- C:\Users\Onkel\Documents\DSC08341.JPG
[2011/07/29 14:55:23 | 000,157,227 | ---- | C] () -- C:\Users\Onkel\Documents\DSC01247.JPG
[2011/07/29 14:55:18 | 000,116,645 | ---- | C] () -- C:\Users\Onkel\Documents\DSC01245.JPG
[2011/07/27 09:40:11 | 002,358,894 | ---- | C] () -- C:\Users\Onkel\Documents\09052011129.jpg
[2011/07/27 09:40:08 | 001,497,447 | ---- | C] () -- C:\Users\Onkel\Documents\09052011117.jpg
[2011/07/24 17:54:43 | 000,000,948 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2011/07/24 17:48:41 | 002,574,324 | ---- | C] () -- C:\Users\Onkel\Documents\bitch.JPG
[2011/07/24 17:42:11 | 001,981,420 | ---- | C] () -- C:\Users\Onkel\Documents\P7180756.JPG
[2011/07/24 13:09:19 | 001,794,999 | ---- | C] () -- C:\Users\Onkel\Documents\IMG_2551.JPG
[2011/07/24 13:07:56 | 000,199,596 | ---- | C] () -- C:\Users\Onkel\Documents\session esther 040.jpg
[2011/07/24 12:44:52 | 006,768,008 | ---- | C] () -- C:\Users\Onkel\Documents\DJ Antoine - Broadway 2011 (Radio Edit).mp3
[2011/07/22 10:02:38 | 000,026,895 | ---- | C] () -- C:\Windows\DIIUnin.dat
[2011/07/21 15:56:32 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2011/07/21 14:33:02 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2011/07/21 14:33:02 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2011/07/21 14:33:02 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2011/06/02 08:59:31 | 000,003,584 | ---- | C] () -- C:\Users\Onkel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/19 11:44:26 | 000,840,580 | ---- | C] () -- C:\ProgramData\LuUninstall.LiveUpdate
[2008/12/23 09:45:59 | 000,000,000 | ---- | C] () -- C:\Windows\tosOBEX.INI
[2008/12/22 17:27:19 | 001,748,352 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2008/12/22 17:27:19 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2008/12/22 17:16:37 | 000,042,559 | ---- | C] () -- C:\ProgramData\nvModes.001
[2008/12/22 17:10:52 | 000,042,559 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2008/12/22 16:21:02 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2008/12/22 16:21:02 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/12/22 15:29:15 | 000,627,756 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008/12/22 15:29:15 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008/12/22 15:29:15 | 000,125,870 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008/12/22 15:29:15 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2007/12/21 20:46:32 | 000,118,784 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll
[2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 000,265,896 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,595,386 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,103,460 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2005/07/23 01:30:18 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll
 
========== LOP Check ==========
 
[2011/07/21 15:47:14 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\DAEMON Tools Pro
[2011/08/21 13:53:27 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\Gutscheinmieze
[2011/08/17 00:12:04 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\ICQ
[2011/08/21 13:53:28 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\logs
[2010/06/19 11:36:54 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\Protector Suite
[2011/08/14 07:11:30 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\Ulead Systems
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2011/07/21 15:46:06 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Pro
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2011/05/02 11:02:49 | 000,000,000 | ---D | M] -- C:\ProgramData\ICQ
[2011/08/14 08:06:15 | 000,000,000 | ---D | M] -- C:\ProgramData\NCH Swift Sound
[2011/07/24 18:18:10 | 000,000,000 | ---D | M] -- C:\ProgramData\PMB Files
[2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2011/07/31 15:33:58 | 000,000,000 | ---D | M] -- C:\ProgramData\TEMP
[2006/11/02 09:02:04 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2008/12/22 17:20:22 | 000,000,000 | ---D | M] -- C:\ProgramData\UIB
[2011/08/14 07:11:29 | 000,000,000 | ---D | M] -- C:\ProgramData\Ulead Systems
[2011/08/21 07:57:22 | 000,032,636 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >

kira 22.08.2011 12:18
1.
Fixen mit OTL
  • Starte die OTL.exe.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Kopiere folgendes Skript:
Code:
:OTL
IE - HKLM\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found
IE - HKU\Onkel_ON_C\..\URLSearchHook: {e36df325-3f4b-476f-8f89-123bc5d51a30} - Reg Error: Key error. File not found

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" =-

:Commands
[purity]
[emptytemp]

** kannst Du wieder normal starten?

2.
läuft unter XP, Vista mit (32Bit) und Windows 7 (32Bit)
Achtung!:
WENN GMER NICHT AUSGEFÜHRT WERDEN KANN ODER PROBMLEME VERURSACHT, fahre mit dem nächsten Punkt fort!- Es ist NICHT sinnvoll einen zweiten Versuch zu starten!
Um einen tieferen Einblick in dein System, um eine mögliche Infektion mit einem Rootkit/Info v.wikipedia.org) aufzuspüren, werden wir ein Tool - Gmer - einsetzen :
  • - also lade Dir Gmer herunter und entpacke es auf deinen Desktop
    - starte gmer.exe
    - [b]schließe alle Programme, ausserdem Antiviren und andere Schutzprogramme usw müssen deaktiviert sein, keine Verbindung zum Internet, WLAN auch trennen)
    - bitte nichts am Pc machen während der Scan läuft!
    - klicke auf "Scan", um das Tool zu starten
    - wenn der Scan fertig ist klicke auf "Copy" (das Log wird automatisch in die Zwischenablage kopiert) und mit STRG + V musst Du gleich da einfügen
    - mit "Ok" wird Gmer beendet.
    - das Log aus der Zwischenablage hier in Deinem Thread vollständig hineinkopieren

** keine Verbindung zu einem Netzwerk und Internet - WLAN nicht vergessen
Wenn der Scan beendet ist, bitte alle Programme und Tools wieder aktivieren!
Anleitung:-> GMER - Rootkit Scanner

3.
Kontrolle mit MBR -t, ob Master Boot Record in Ordnung ist (MBR-Rootkit)

Mit dem folgenden Tool prüfen wir, ob sich etwas Schädliches im Master Boot Record eingenistet hat.
  • Downloade die MBR.exe von Gmer und
    kopiere die Datei mbr.exe in den Ordner C:\Windows\system32.
    Falls Du den Ordner nicht sehen kannst, diese Einstellungen in den Ordneroptionen vornehmen.
  • Start => ausführen => cmd (da reinschreiben) => OK
    es öffnet sich eine Eingabeaufforderung.

    Vista- und Windows 7-User: Start => Alle Programme => Zubehör => Rechtsklick auf Eingabeaufforderung und wähle Als Administrator ausführen.
  • Nach dem Prompt (>_) folgenden

    aus der Codebox manuell eingeben oder alternativ den mit STRG + C ins Clipboard kopieren und einfügen.
    Einfügen in der Eingabeaufforderung: in der Titelleiste einen Rechtsklick machen => Bearbeiten => einfügen.

    Code:
    mbr.exe -t > C:\mbr.log & C:\mbr.log
    (Enter drücken)
  • Nach kurzer Zeit wird sich Dein Editor öffnen und die Datei C:\mbr.log beinhalten.
    Bitte kopiere den Inhalt hier in Deinen Thread.
4.
Lade Dir Malwarebytes Anti-Malware von→ malwarebytes.org
  • Installieren und per Doppelklick starten.
  • Deutsch einstellen und gleich mal die Datenbanken zu aktualisieren - online updaten
  • "Komplett Scan durchführen" wählen (überall Haken setzen)
  • wenn der Scanvorgang beendet ist, klicke auf "Zeige Resultate"
  • alle Funde bis auf "Restore bzw systemwiederherstellung" markieren und auf "Löschen" - "Ausgewähltes entfernen") klicken.
  • Poste das Ergebnis hier in den Thread - den Bericht findest Du unter "Scan-Berichte"
eine bebilderte Anleitung findest Du hier: Anleitung


Alle Zeitangaben in WEZ +1. Es ist jetzt 09:17 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131