Geehrte Damen und Herren. hab jetzt seit kurzem mit den Metropolitan Police Trojaner zu kämpfen. Im forum habe ich mich schon ma a weng umgeschaut und mich informiert... wie gefolgt, habe ich eine Boot CD erstellt. vom komputer aus gebootet, auf dem RETAGO Desktop. bin ich weiter auf OTLPE Icon drauf und Habe Das System gescant.. nun poste ich hier meinen OTL.Txt bitte dringend um schnelle hilfe....

Danke im Vorraus. viel grüße..... ANDY


OTL logfile created on: 6/28/2011 8:54:37 PM - Run
OTLPE by OldTimer - Version 3.1.46.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.2180)
Locale: | Country: | Language: | Date Format:

1,022.00 Mb Total Physical Memory | 823.00 Mb Available Physical Memory | 81.00% Memory free
906.00 Mb Paging File | 852.00 Mb Available in Paging File | 94.00% Paging File free
Paging file location(s): C:\pagefile.sys 1536 3072 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 19.53 Gb Total Space | 1.33 Gb Free Space | 6.80% Space Free | Partition Type: NTFS
Drive D: | 46.00 Gb Total Space | 4.57 Gb Free Space | 9.94% Space Free | Partition Type: NTFS
Drive E: | 46.25 Gb Total Space | 1.72 Gb Free Space | 3.71% Space Free | Partition Type: NTFS
Drive X: | 284.12 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto] -- -- (x10nets)
SRV - File not found [Auto] -- -- (WudfSvcSpooler)
SRV - File not found [Auto] -- -- (wscsvcehRecvr)
SRV - File not found [Auto] -- -- (TUWinStylerThemeSvcodbcasvc)
SRV - File not found [Auto] -- -- (TapiSrvMHN)
SRV - File not found [Auto] -- -- (SwPrvImapiService)
SRV - File not found [Auto] -- -- (srserviceRemoteRegistryAppMgmt)
SRV - File not found [Auto] -- -- (srserviceRemoteRegistry)
SRV - File not found [Auto] -- -- (srservicePolicyAgentERSvc)
SRV - File not found [Auto] -- -- (SpoolerWmi)
SRV - File not found [Auto] -- -- (SpoolerSENS)
SRV - File not found [Auto] -- -- (SharedAccessCiSvcTermServiceW32Time)
SRV - File not found [Auto] -- -- (SharedAccessCiSvcTermService)
SRV - File not found [Auto] -- -- (seclogonAntiVirScheduler)
SRV - File not found [Auto] -- -- (ScheduleMSDTCERSvc)
SRV - File not found [Auto] -- -- (ScheduleMSDTC)
SRV - File not found [Auto] -- -- (Scheduleaspnet_state)
SRV - File not found [Auto] -- -- (S24EventMonitorVSS) Intel(R)
SRV - File not found [Auto] -- -- (RSVPSysmonLog)
SRV - File not found [On_Demand] -- -- (rpcapd) Remote Packet Capture Protocol v.0 (experimental)
SRV - File not found [Auto] -- -- (RegSrvcWmi) Intel(R)
SRV - File not found [Auto] -- -- (RegSrvcShellHWDetection) Intel(R)
SRV - File not found [Auto] -- -- (RasAutoS24EventMonitor)
SRV - File not found [Auto] -- -- (PolicyAgentPolicyAgent)
SRV - File not found [Auto] -- -- (PolicyAgentERSvcRasManSCardSvr)
SRV - File not found [Auto] -- -- (PolicyAgentERSvcRasMan)
SRV - File not found [Auto] -- -- (PolicyAgentERSvc)
SRV - File not found [Auto] -- -- (PlugPlaySamSsTUWinStylerThemeSvcodbcasvc)
SRV - File not found [Auto] -- -- (PlugPlaySamSs)
SRV - File not found [Auto] -- -- (oseAudioSrvScheduleMSDTC)
SRV - File not found [Auto] -- -- (oseAudioSrv)
SRV - File not found [Auto] -- -- (odbcasvc)
SRV - File not found [Auto] -- -- (NetmanTermService)
SRV - File not found [Auto] -- -- (NetDDEdsdmPlugPlay)
SRV - File not found [Auto] -- -- (MDMPolicyAgent)
SRV - File not found [Auto] -- -- (MDMNetDDE)
SRV - File not found [Auto] -- -- (McrdSvcMHN)
SRV - File not found [Auto] -- -- (HTTPFilterstisvc)
SRV - File not found [Auto] -- -- (FastUserSwitchingCompatibilityFastUserSwitchingCompatibility)
SRV - File not found [Auto] -- -- (DnscacheScheduleaspnet_stateStarWindService)
SRV - File not found [Auto] -- -- (DnscacheScheduleaspnet_state)
SRV - File not found [Auto] -- -- (DnscacheRegSrvcWmi)
SRV - File not found [Auto] -- -- (dmadminStarWindService)
SRV - File not found [Auto] -- -- (CiSvcTermService)
SRV - File not found [Auto] -- -- (AudioSrvMSIServer)
SRV - File not found [Auto] -- -- (aspnet_stateLmHosts)
SRV - File not found [Auto] -- -- (AntiVirScheduleraspnet_stateWmi)
SRV - File not found [Auto] -- -- (AntiVirScheduleraspnet_state)
SRV - File not found [Auto] -- -- (ALGHidServ)
SRV - [2011/05/25 23:50:55 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/03/23 01:01:17 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2010/05/11 13:51:52 | 000,604,488 | ---- | M] (TuneUp Software) [Auto] -- C:\WINDOWS\system32\TUProgSt.exe -- (TuneUp.ProgramStatisticsSvc)
SRV - [2010/05/11 13:51:48 | 000,361,288 | ---- | M] (TuneUp Software) [On_Demand] -- C:\WINDOWS\system32\TuneUpDefragService.exe -- (TuneUp.Defrag)
SRV - [2009/11/16 06:25:48 | 000,029,000 | ---- | M] (TuneUp Software) [Auto] -- C:\WINDOWS\system32\uxtuneup.dll -- (UxTuneUp)
SRV - [2009/09/11 06:33:54 | 000,009,216 | ---- | M] (Vodafone) [Auto] -- C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe -- (VMCService)
SRV - [2008/07/11 16:08:31 | 000,069,120 | ---- | M] (Autodata Limited) [Auto] -- C:\Programme\Gemeinsame Dateien\Autodata Limited Shared\Service\ADCDLicSvc.exe -- (Autodata Limited License Service)
SRV - [2005/04/03 19:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2005/04/01 20:51:48 | 000,217,600 | ---- | M] (Rocket Division Software) [Auto] -- C:\Programme\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe -- (StarWindService)
SRV - [2005/01/17 19:38:38 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto] -- C:\Programme\Toshiba\ConfigFree\CFSvcs.exe -- (CFSvcs)
SRV - [2004/08/05 08:00:00 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2003/06/19 18:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand] -- -- (X10Hid)
DRV - File not found [Kernel | Boot] -- -- (Winyi54)
DRV - File not found [Kernel | Boot] -- -- (Winyi32)
DRV - File not found [Kernel | Boot] -- -- (Winyi00)
DRV - File not found [Kernel | Boot] -- -- (Winxh77)
DRV - File not found [Kernel | Boot] -- -- (Winxh44)
DRV - File not found [Kernel | Boot] -- -- (Winxg76)
DRV - File not found [Kernel | Boot] -- -- (Winvf32)
DRV - File not found [Kernel | Boot] -- -- (Winvf21)
DRV - File not found [Kernel | Boot] -- -- (Winve66)
DRV - File not found [Kernel | Boot] -- -- (Winue66)
DRV - File not found [Kernel | Boot] -- -- (Winsc08)
DRV - File not found [Kernel | Boot] -- -- (Winsb31)
DRV - File not found [Kernel | Boot] -- -- (Winsb10)
DRV - File not found [Kernel | Boot] -- -- (Winrb65)
DRV - File not found [Kernel | Boot] -- -- (Winpy21)
DRV - File not found [Kernel | Boot] -- -- (Winpa43)
DRV - File not found [Kernel | Boot] -- -- (Winoy77)
DRV - File not found [Kernel | Boot] -- -- (Winnu31)
DRV - File not found [Kernel | Boot] -- -- (Winmv76)
DRV - File not found [Kernel | Boot] -- -- (Winmv43)
DRV - File not found [Kernel | Boot] -- -- (Winmv21)
DRV - File not found [Kernel | Boot] -- -- (Winmv11)
DRV - File not found [Kernel | Boot] -- -- (Winmt75)
DRV - File not found [Kernel | Boot] -- -- (Winlu10)
DRV - File not found [Kernel | Boot] -- -- (Winkt54)
DRV - File not found [Kernel | Boot] -- -- (Winkt08)
DRV - File not found [Kernel | Boot] -- -- (Winjq64)
DRV - File not found [Kernel | Boot] -- -- (Winis77)
DRV - File not found [Kernel | Boot] -- -- (Winir76)
DRV - File not found [Kernel | Boot] -- -- (Winir44)
DRV - File not found [Kernel | Boot] -- -- (Winir11)
DRV - File not found [Kernel | Boot] -- -- (Winip53)
DRV - File not found [Kernel | Boot] -- -- (Winhq10)
DRV - File not found [Kernel | Boot] -- -- (Winfp22)
DRV - File not found [Kernel | Boot] -- -- (Winfo54)
DRV - File not found [Kernel | Boot] -- -- (Windm88)
DRV - File not found [Kernel | Boot] -- -- (Windm22)
DRV - File not found [Kernel | Boot] -- -- (Windm08)
DRV - File not found [Kernel | Boot] -- -- (Wincl65)
DRV - File not found [Kernel | Boot] -- -- (Wincl08)
DRV - File not found [Kernel | Boot] -- -- (Winbk22)
DRV - File not found [Kernel | Boot] -- -- (Winbj65)
DRV - File not found [Kernel | On_Demand] -- -- (WDICA)
DRV - File not found [Kernel | System] -- -- (VClone)
DRV - File not found [Kernel | On_Demand] -- -- (USBAAPL)
DRV - File not found [Kernel | On_Demand] -- -- (UIUSys)
DRV - File not found [Kernel | On_Demand] -- -- (SYMIDSCO)
DRV - File not found [Kernel | Auto] -- -- (SSPORT)
DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP)
DRV - File not found [Kernel | System] -- -- (PCIDump)
DRV - File not found [Kernel | System] -- -- (lbrtfdc)
DRV - File not found [Kernel | System] -- -- (InCDRm)
DRV - File not found [Kernel | System] -- -- (InCDPass)
DRV - File not found [Kernel | System] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand] -- -- (hwdatacard)
DRV - File not found [Kernel | On_Demand] -- -- (GCKNDIS5)
DRV - File not found [Kernel | On_Demand] -- -- (GCKMPR5)
DRV - File not found [Kernel | On_Demand] -- -- (ewusbnet)
DRV - File not found [Kernel | System] -- -- (Changer)
DRV - [2011/03/23 01:01:18 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2010/11/26 14:06:39 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009/06/29 12:00:50 | 000,102,656 | R--- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ewusbfake.sys -- (hwusbfake)
DRV - [2009/05/11 04:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/02/13 05:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008/12/23 11:35:02 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\npf.sys -- (NPF)
DRV - [2008/10/09 07:50:08 | 000,022,528 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\BMLoad.sys -- (BMLoad)
DRV - [2008/10/09 07:50:04 | 000,018,816 | ---- | M] (Bytemobile, Inc.) [Kernel | System] -- C:\WINDOWS\System32\drivers\tcpipBM.sys -- (tcpipBM)
DRV - [2008/01/09 21:34:57 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\DGIVECP.SYS -- (DgiVecp)
DRV - [2006/01/17 11:30:58 | 000,015,744 | R--- | M] (SMSC) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HIDSMSC.SYS -- (SMCB000)
DRV - [2006/01/12 11:21:18 | 000,031,872 | ---- | M] (Quanta Computer, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\qkbfiltr.sys -- (qkbfiltr)
DRV - [2005/12/29 17:20:38 | 000,561,664 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\CHDAud.sys -- (HdAudAddService)
DRV - [2005/12/05 04:55:30 | 001,428,096 | ---- | M] (Intel® Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) Intel(R)
DRV - [2005/12/01 17:19:04 | 000,024,064 | ---- | M] (Option N.V.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\g3gruser.sys -- (G3GRUSER)
DRV - [2005/12/01 17:19:02 | 000,027,648 | ---- | M] (Option N.V.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\g3grumdm.sys -- (G3GRUMDM)
DRV - [2005/12/01 17:19:02 | 000,018,688 | ---- | M] (Option N.V.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\g3grsc.sys -- (G3GRSC)
DRV - [2005/11/30 13:12:00 | 000,162,560 | ---- | M] (Texas Instruments) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21)
DRV - [2005/11/28 06:09:26 | 000,013,568 | ---- | M] (Intel Corporation) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2005/11/08 18:12:00 | 000,997,376 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_DPV.sys -- (HSF_DPV)
DRV - [2005/11/08 18:11:00 | 000,723,712 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys -- (winachsf)
DRV - [2005/11/08 18:11:00 | 000,202,240 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HSFHWAZL.sys -- (HSFHWAZL)
DRV - [2005/09/09 09:47:10 | 000,009,344 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tosrfec.sys -- (tosrfec)
DRV - [2005/06/11 00:42:00 | 000,005,504 | ---- | M] (Quanta Computer Corp) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\BoiHwSetup.sys -- (BoiHwsetup)
DRV - [2005/05/05 09:27:38 | 000,007,936 | ---- | M] (Quanta Computer, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\qmofiltr.sys -- (qmofiltr)
DRV - [2005/04/25 05:43:58 | 000,159,616 | ---- | M] ( ) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\Vax347b.sys -- (Vax347b)
DRV - [2004/08/10 09:00:00 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2004/04/30 04:33:00 | 000,005,248 | ---- | M] ( ) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\Vax347s.sys -- (Vax347s)
DRV - [2003/09/18 20:47:00 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\pfc.sys -- (Pfc)
DRV - [2003/01/29 17:35:00 | 000,012,032 | ---- | M] (TOSHIBA Corporation.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\Netdevio.sys -- (Netdevio)
DRV - [2001/08/17 08:05:20 | 000,031,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\OVCE.sys -- (QCEmerald)
DRV - [2001/08/17 08:05:06 | 000,025,216 | ---- | M] (Microsoft Corporation) [Kernel | System] -- C:\WINDOWS\system32\drivers\OVSound2.sys -- (lusbaudio)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\boss.EUGEN.004_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://nl.ask.com/?o=15161&l=dis
IE - HKU\boss.EUGEN.004_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0




FF - HKLM\software\mozilla\Firefox\extensions\\ff-bmboc@bytemobile.com: C:\Programme\Vodafone\Vodafone Mobile Connect\Optimization Client\addon\ [2010/08/19 11:30:15 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.19\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011/05/05 23:59:08 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.19\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011/05/05 23:59:08 | 000,000,000 | ---D | M]

[2011/06/18 16:45:30 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011/05/05 23:58:59 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2011/05/05 23:58:59 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2011/05/05 23:58:59 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2011/05/05 23:58:59 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2011/05/05 23:58:59 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2009/02/05 18:17:07 | 000,000,928 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3 - HKU\boss.EUGEN.004_ON_C\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKU\boss.EUGEN.004_ON_C\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\boss.EUGEN.004_ON_C\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] C:\WINDOWS\System32\CHDAudPropShortcut.exe (Windows (R) Server 2003 DDK provider)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [MobileConnect] C:\Programme\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe (Vodafone)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - Startup: Error locating startup folders.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\boss.EUGEN.004_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: ???????? ??????, ??????? ?? ?????? ?????? ???????? - {DAC5944B-F843-4b90-B605-09DE3360CDE6} - Reg Error: Key error. File not found
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} hxxp://static.pe.schuelervz.net/photouploader/ImageUploader5.cab?nocache=1210422508 (Image Uploader Control)
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab (Java Plug-in 1.5.0_04)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (C:\DOKUME~1\BOSSEU~1.004\LOKALE~1\Temp\0.8068671470946516.exe) - C:\Dokumente und Einstellungen\boss.EUGEN.004\Lokale Einstellungen\Temp\0.8068671470946516.exe (BitDefender)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/17 08:02:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/01/06 11:15:05 | 000,000,000 | ---D | M] - D:\Autodata 2005 -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/06/16 11:11:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\boss.EUGEN.004\Desktop\Urlaub
[2006/11/02 13:42:47 | 000,159,616 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\Vax347b.sys
[2006/11/02 13:42:47 | 000,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\Vax347s.sys
[2006/10/15 04:12:44 | 011,732,512 | ---- | C] (RealNetworks, Inc.) -- C:\Programme\RealPlayer10-5GOLD_de.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/26 20:02:34 | 000,000,490 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job
[2011/06/26 20:02:18 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/06/26 20:02:12 | 1071,828,992 | -HS- | M] () -- C:\hiberfil.sys
[2011/06/26 18:33:06 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/06/19 15:11:02 | 000,045,378 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011/06/15 14:19:41 | 000,021,504 | ---- | M] () -- C:\WINDOWS\jestertb.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/15 14:19:41 | 000,021,504 | ---- | C] () -- C:\WINDOWS\jestertb.dll
[2011/05/11 15:27:40 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\boss.EUGEN.004\2gweorjqjutp92vjy9gake
[2011/03/09 01:48:07 | 000,000,092 | ---- | C] () -- C:\Dokumente und Einstellungen\boss.EUGEN.004\default.pls
[2009/10/20 13:50:37 | 000,479,232 | ---- | C] () -- C:\WINDOWS\ssndii.exe
[2009/10/20 13:50:04 | 000,022,723 | ---- | C] () -- C:\WINDOWS\System32\ssp2ml3.dll
[2009/10/17 13:08:23 | 000,012,800 | ---- | C] () -- C:\Dokumente und Einstellungen\boss.EUGEN.004\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/10/17 03:49:24 | 000,000,147 | ---- | C] () -- C:\Dokumente und Einstellungen\boss.EUGEN.004\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2009/06/16 07:25:02 | 000,121,512 | R--- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DeviceManager.xml.rc4
[2009/05/12 14:00:30 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2008/12/23 11:33:18 | 000,053,299 | ---- | C] () -- C:\WINDOWS\System32\pthreadVC.dll
[2008/08/02 13:20:34 | 000,000,032 | ---- | C] () -- C:\WINDOWS\System32\2093064700.dat
[2008/08/01 05:13:59 | 100,580,168 | -HS- | C] () -- C:\WINDOWS\System32\apphelpc.sys
[2008/07/23 12:50:52 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008/07/23 12:46:38 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2008/07/18 13:53:51 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2007/12/10 16:30:01 | 000,000,098 | ---- | C] () -- C:\WINDOWS\WirelessFTP.INI
[2007/11/01 06:24:47 | 007,749,120 | ---- | C] () -- C:\Programme\avwinsfx07.exe
[2007/11/01 05:20:11 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2007/05/08 13:44:31 | 000,111,104 | ---- | C] () -- C:\WINDOWS\System32\uha.exe
[2007/02/19 13:02:10 | 000,000,002 | ---- | C] () -- C:\WINDOWS\ActiveXMSSMSCache.dat
[2006/12/20 14:04:20 | 000,000,620 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/11/20 15:53:35 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI
[2006/11/20 11:56:24 | 000,000,305 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\addr_file.html
[2006/11/02 13:43:10 | 000,034,308 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2006/11/02 13:41:30 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2006/10/15 03:52:53 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
[2006/03/22 05:12:20 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2006/03/22 04:56:06 | 000,000,466 | ---- | C] () -- C:\WINDOWS\TBTdetect.ini
[2006/03/22 04:25:13 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2006/03/22 03:05:11 | 000,012,402 | ---- | C] () -- C:\WINDOWS\HWSetupStr.ini
[2006/03/22 03:05:11 | 000,002,182 | R--- | C] () -- C:\WINDOWS\SVPW32Str.ini
[2006/03/22 02:55:00 | 000,000,222 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2006/03/22 02:49:17 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2006/03/22 02:49:17 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2006/03/22 02:49:17 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2006/03/22 02:49:17 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2006/03/22 02:49:17 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2006/03/22 02:49:17 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2006/03/22 02:47:43 | 000,127,184 | ---- | C] () -- C:\WINDOWS\Unwise.exe
[2006/03/22 02:18:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NDSTray.INI
[2006/03/21 17:06:57 | 001,519,616 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2006/03/21 17:06:56 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2006/03/21 17:06:55 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2006/03/21 17:06:55 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2006/03/21 17:06:53 | 001,466,368 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2006/03/21 17:06:53 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2006/03/21 17:06:53 | 000,573,440 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2006/03/21 17:06:50 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2006/03/21 17:06:50 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll
[2006/03/21 17:06:49 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2006/03/21 11:04:04 | 000,009,362 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini
[2006/03/21 11:04:04 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini
[2006/03/21 11:04:03 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini
[2006/03/21 11:04:03 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll
[2006/03/17 08:05:33 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2006/03/17 07:58:42 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2006/03/17 07:53:09 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2006/03/17 07:52:18 | 000,260,640 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2006/03/17 07:46:26 | 000,159,744 | ---- | C] () -- C:\WINDOWS\MakeMrk.exe
[2006/03/17 07:46:26 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\ToshBIOS.dll
[2006/03/17 07:46:26 | 000,000,083 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2006/03/17 07:46:14 | 000,456,056 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2006/03/17 07:46:14 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2006/03/17 07:46:14 | 000,083,210 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2006/03/17 07:46:14 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2006/03/17 07:45:42 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2006/03/17 07:45:40 | 000,438,076 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006/03/17 07:45:40 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2006/03/17 07:45:40 | 000,070,006 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006/03/17 07:45:40 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2006/03/17 07:45:40 | 000,004,631 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2006/03/17 07:45:38 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2006/03/17 07:45:37 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2006/03/17 07:45:29 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2006/03/17 07:45:29 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2006/03/17 07:45:26 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2006/03/17 07:45:18 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2006/01/26 13:03:32 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\TPeculiarity.dll
[2005/12/08 14:56:50 | 000,151,552 | ---- | C] () -- C:\WINDOWS\System32\tsbwls.dll
[2005/08/05 09:26:04 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005/04/28 00:22:34 | 000,831,488 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll
[2005/04/28 00:22:34 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll
[2004/08/05 08:00:00 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2004/01/13 21:46:00 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\tifmicon.dll

========== LOP Check ==========

[2010/08/12 14:04:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Bytemobile
[2010/01/05 10:26:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\boss.EUGEN.004\Anwendungsdaten\.pknowledge
[2010/11/12 16:27:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\boss.EUGEN.004\Anwendungsdaten\becker
[2009/10/17 04:14:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\boss.EUGEN.004\Anwendungsdaten\MSNInstaller
[2006/04/14 14:40:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\boss.EUGEN.004\Anwendungsdaten\toshiba
[2009/10/18 14:07:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\boss.EUGEN.004\Anwendungsdaten\TuneUp Software
[2011/05/21 14:27:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\boss.EUGEN.004\Anwendungsdaten\uTorrent
[2010/08/12 09:05:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\boss.EUGEN.004\Anwendungsdaten\Vodafone
[2010/08/12 09:09:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\boss.EUGEN.004\Anwendungsdaten\Vodafone Mobile Connect
[2010/08/12 09:05:51 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Bytemobile
[2009/03/21 11:03:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Vodafone
[2006/04/14 14:44:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\X10 Commander
[2008/08/02 14:59:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Autodata Limited
[2011/02/25 12:01:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Autodesk
[2006/12/20 17:00:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Phenomedia
[2008/10/05 05:36:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2006/11/02 14:03:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2010/08/19 11:30:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Vodafone
[2010/05/11 13:50:32 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{55A29068-F2CE-456C-9148-C869879E2357}
[2011/06/26 20:02:34 | 000,000,490 | ---- | M] () -- C:\WINDOWS\Tasks\1-Klick-Wartung.job

========== Purity Check ==========



========== Files - Unicode (All) ==========
[2010/12/21 05:56:56 | 005,558,933 | ---- | M] ()(C:\Dokumente und Einstellungen\boss.EUGEN.004\Desktop\Nyusha ???? - ???????? ???? ( The official TV version ).mp3) -- C:\Dokumente und Einstellungen\boss.EUGEN.004\Desktop\Nyusha ???? - ???????? ???? ( The official TV version ).mp3
[2010/12/21 05:35:35 | 005,558,933 | ---- | C] ()(C:\Dokumente und Einstellungen\boss.EUGEN.004\Desktop\Nyusha ???? - ???????? ???? ( The official TV version ).mp3) -- C:\Dokumente und Einstellungen\boss.EUGEN.004\Desktop\Nyusha ???? - ???????? ???? ( The official TV version ).mp3

========== Alternate Data Streams ==========

@Alternate Data Stream - 113 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:CB0AACC9
< End of report >

Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
DRV - File not found [Kernel | Boot] -- -- (Winyi54)
DRV - File not found [Kernel | Boot] -- -- (Winyi32)
DRV - File not found [Kernel | Boot] -- -- (Winyi00)
DRV - File not found [Kernel | Boot] -- -- (Winxh77)
DRV - File not found [Kernel | Boot] -- -- (Winxh44)
DRV - File not found [Kernel | Boot] -- -- (Winxg76)
DRV - File not found [Kernel | Boot] -- -- (Winvf32)
DRV - File not found [Kernel | Boot] -- -- (Winvf21)
DRV - File not found [Kernel | Boot] -- -- (Winve66)
DRV - File not found [Kernel | Boot] -- -- (Winue66)
DRV - File not found [Kernel | Boot] -- -- (Winsc08)
DRV - File not found [Kernel | Boot] -- -- (Winsb31)
DRV - File not found [Kernel | Boot] -- -- (Winsb10)
DRV - File not found [Kernel | Boot] -- -- (Winrb65)
DRV - File not found [Kernel | Boot] -- -- (Winpy21)
DRV - File not found [Kernel | Boot] -- -- (Winpa43)
DRV - File not found [Kernel | Boot] -- -- (Winoy77)
DRV - File not found [Kernel | Boot] -- -- (Winnu31)
DRV - File not found [Kernel | Boot] -- -- (Winmv76)
DRV - File not found [Kernel | Boot] -- -- (Winmv43)
DRV - File not found [Kernel | Boot] -- -- (Winmv21)
DRV - File not found [Kernel | Boot] -- -- (Winmv11)
DRV - File not found [Kernel | Boot] -- -- (Winmt75)
DRV - File not found [Kernel | Boot] -- -- (Winlu10)
DRV - File not found [Kernel | Boot] -- -- (Winkt54)
DRV - File not found [Kernel | Boot] -- -- (Winkt08)
DRV - File not found [Kernel | Boot] -- -- (Winjq64)
DRV - File not found [Kernel | Boot] -- -- (Winis77)
DRV - File not found [Kernel | Boot] -- -- (Winir76)
DRV - File not found [Kernel | Boot] -- -- (Winir44)
DRV - File not found [Kernel | Boot] -- -- (Winir11)
DRV - File not found [Kernel | Boot] -- -- (Winip53)
DRV - File not found [Kernel | Boot] -- -- (Winhq10)
DRV - File not found [Kernel | Boot] -- -- (Winfp22)
DRV - File not found [Kernel | Boot] -- -- (Winfo54)
DRV - File not found [Kernel | Boot] -- -- (Windm88)
DRV - File not found [Kernel | Boot] -- -- (Windm22)
DRV - File not found [Kernel | Boot] -- -- (Windm08)
DRV - File not found [Kernel | Boot] -- -- (Wincl65)
DRV - File not found [Kernel | Boot] -- -- (Wincl08)
DRV - File not found [Kernel | Boot] -- -- (Winbk22)
DRV - File not found [Kernel | Boot] -- -- (Winbj65)
IE - HKU\boss.EUGEN.004_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://nl.ask.com/?o=15161&l=dis
IE - HKU\boss.EUGEN.004_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
O3 - HKU\boss.EUGEN.004_ON_C\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKU\boss.EUGEN.004_ON_C\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\boss.EUGEN.004_ON_C\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O9 - Extra Button: ???????? ??????, ??????? ?? ?????? ?????? ???????? - {DAC5944B-F843-4b90-B605-09DE3360CDE6} - Reg Error: Key error. File not found
O20 - HKLM Winlogon: Shell - (C:\DOKUME~1\BOSSEU~1.004\LOKALE~1\Temp\0.8068671470946516.exe) - C:\Dokumente und Einstellungen\boss.EUGEN.004\Lokale Einstellungen\Temp\0.8068671470946516.exe (BitDefender)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/17 08:02:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009/01/06 11:15:05 | 000,000,000 | ---D | M] - D:\Autodata 2005 -- [ NTFS ]
[2011/06/15 14:19:41 | 000,021,504 | ---- | C] () -- C:\WINDOWS\jestertb.dll
[2011/05/11 15:27:40 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\boss.EUGEN.004\2gweorjqjutp92vjy9gake
@Alternate Data Stream - 113 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:CB0AACC9
:Commands
[purity]
[resethosts]
         

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen!
2.) Ordner movedfiles in C:\_OTL in eine Datei zippen
3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html
4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winyi54 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winyi32 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winyi00 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winxh77 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winxh44 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winxg76 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winvf32 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winvf21 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winve66 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winue66 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winsc08 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winsb31 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winsb10 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winrb65 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winpy21 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winpa43 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winoy77 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winnu31 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winmv76 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winmv43 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winmv21 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winmv11 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winmt75 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winlu10 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winkt54 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winkt08 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winjq64 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winis77 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winir76 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winir44 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winir11 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winip53 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winhq10 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winfp22 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winfo54 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Windm88 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Windm22 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Windm08 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wincl65 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Wincl08 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winbk22 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winbj65 deleted successfully.
HKU\boss.EUGEN.004_ON_C\Software\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\boss.EUGEN.004_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Registry value HKEY_USERS\boss.EUGEN.004_ON_C\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{C4069E3A-68F1-403E-B40E-20066696354B} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C4069E3A-68F1-403E-B40E-20066696354B}\ not found.
Registry value HKEY_USERS\boss.EUGEN.004_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7}\ not found.
Registry value HKEY_USERS\boss.EUGEN.004_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{DAC5944B-F843-4b90-B605-09DE3360CDE6}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DAC5944B-F843-4b90-B605-09DE3360CDE6}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\DOKUME~1\BOSSEU~1.004\LOKALE~1\Temp\0.8068671470946516.exe deleted successfully.
C:\Dokumente und Einstellungen\boss.EUGEN.004\Lokale Einstellungen\Temp\0.8068671470946516.exe moved successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
File not found.
C:\WINDOWS\jestertb.dll moved successfully.
C:\Dokumente und Einstellungen\boss.EUGEN.004\2gweorjqjutp92vjy9gake moved successfully.
ADS C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:CB0AACC9 deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTLPE by OldTimer - Version 3.1.46.0 log created on 07072011_015054






das ist das ergebniss

Du solltest aber auch noch was hochladen