| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Bundespolizei TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
07.08.2011, 14:26
| #1 |
| |  Bundespolizei Trojaner Hallo, Seit heute habe ich das Problem, dass bei meinem PC kurz nach der Anmeldung im normalen Modus die Aufschrift mit der Bundespolizei kommt, die jedem, der das hier liest bekannt sein dürfte. Ich bin Arnes Anweisungen gefolgt und habe die beiden Textdateien mitgepostet. Übrigens Danke für die Hilfe! Was muss ich jetzt tun?OTL Logfile: Code:
ATTFilter OTL logfile created on: 8/7/2011 4:09:47 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Windows Vista (TM) Home Premium Service Pack 1 (Version = 6.0.6001) - Type = System
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 581.10 Gb Total Space | 169.90 Gb Free Space | 29.24% Space Free | Partition Type: NTFS
Drive H: | 15.00 Gb Total Space | 9.63 Gb Free Space | 64.20% Space Free | Partition Type: NTFS
Drive J: | 1003.99 Mb Total Space | 694.61 Mb Free Space | 69.18% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
========== Win32 Services (SafeList) ==========
SRV - File not found [Auto] -- -- (NMSAccessU)
SRV - [2011/07/13 21:26:13 | 000,411,432 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2010/10/26 17:42:14 | 004,869,488 | ---- | M] (Wacom Technology, Corp.) [Auto] -- C:\Program Files\Tablet\Pen\Pen_Tablet.exe -- (TabletServicePen)
SRV - [2010/10/26 17:42:14 | 000,416,112 | ---- | M] (Wacom Technology, Corp.) [Auto] -- C:\Program Files\Tablet\Pen\Pen_TouchService.exe -- (TouchServicePen)
SRV - [2010/06/07 11:05:06 | 000,240,232 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2010/02/19 07:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009/08/05 09:37:39 | 000,185,089 | ---- | M] (Avira GmbH) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009/06/09 08:45:15 | 000,108,289 | ---- | M] (Avira GmbH) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2008/11/05 18:24:47 | 000,016,680 | ---- | M] (Citrix Online, a division of Citrix Systems, Inc.) [On_Demand] -- C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe -- (GoToAssist)
SRV - [2008/08/26 11:58:12 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Auto] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter)
SRV - [2008/08/07 06:17:30 | 000,575,488 | ---- | M] (Nokia.) [On_Demand] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2008/07/18 08:42:08 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) [Auto] -- C:\Windows\System32\AERTSrv.exe -- (AERTFilters)
SRV - [2008/05/02 10:09:04 | 000,161,048 | ---- | M] (Stardock Corporation) [Auto] -- C:\Program Files\Dell\DellDock\DockLogin.exe -- (DockLoginService)
SRV - [2008/01/20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/07/24 06:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2007/01/04 14:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto] -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)
SRV - [2006/12/27 19:02:00 | 000,356,352 | R--- | M] (AVM Berlin) [Auto] -- C:\Program Files\avmwlanstick\WLanNetService.exe -- (AVM WLAN Connection Service)
SRV - [2006/12/14 12:00:00 | 000,544,768 | ---- | M] (Magix AG) [On_Demand] -- C:\Program Files\Common Files\MAGIX Shared\UPnPService\UPnPService.exe -- (UPnPService)
SRV - [2005/11/17 10:18:52 | 001,527,900 | ---- | M] (MAGIX®) [On_Demand] -- C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand] -- -- (IpInIp)
DRV - [2010/10/11 15:19:36 | 000,016,240 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacmoumonitor.sys -- (wacmoumonitor)
DRV - [2010/10/11 15:19:28 | 000,011,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacommousefilter.sys -- (wacommousefilter)
DRV - [2010/10/11 15:19:26 | 000,014,120 | ---- | M] (Wacom Technology) [Kernel | On_Demand] -- C:\Windows\System32\drivers\wacomvhid.sys -- (wacomvhid)
DRV - [2010/06/07 19:57:00 | 010,888,168 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/12/08 07:00:33 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2009/07/11 22:50:11 | 000,015,872 | ---- | M] () [Kernel | On_Demand] -- C:\Users\KevBeatzProductionz\AppData\Local\Temp\krdpdre.sys -- (krdpdre)
DRV - [2009/07/01 16:56:57 | 000,097,792 | ---- | M] (Protect Software GmbH) [Kernel | Auto] -- C:\Windows\System32\drivers\ACEDRV05.sys -- (ACEDRV05)
DRV - [2009/06/09 08:45:15 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/03/30 04:33:03 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2009/02/13 06:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008/07/21 07:18:20 | 000,027,648 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | Auto] -- C:\Windows\System32\drivers\RtNdPt60.sys -- (RtNdPt60)
DRV - [2008/07/10 07:28:50 | 000,123,904 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2008/06/06 04:24:44 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2008/05/07 02:38:36 | 000,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2008/05/07 02:38:20 | 000,020,864 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2008/05/07 02:38:20 | 000,017,536 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2008/01/23 04:19:44 | 000,501,560 | ---- | M] (Protect Software GmbH) [Kernel | Auto] -- C:\Windows\System32\drivers\ACEDRV11.sys -- (acedrv11)
DRV - [2008/01/20 22:23:25 | 000,251,904 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\VSTBS23.SYS -- (VSTHWBS2)
DRV - [2008/01/20 22:23:25 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2007/09/17 10:53:26 | 000,021,632 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2007/04/17 15:09:28 | 000,011,032 | ---- | M] (InterVideo) [Kernel | Auto] -- C:\Windows\System32\drivers\regi.sys -- (regi)
DRV - [2006/12/27 19:02:00 | 000,265,088 | ---- | M] (AVM GmbH) [Kernel | On_Demand] -- C:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV - [2006/12/27 19:02:00 | 000,004,352 | R--- | M] (AVM Berlin) [Kernel | On_Demand] -- C:\Windows\System32\drivers\avmeject.sys -- (avmeject)
DRV - [2006/11/02 03:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2002/07/01 10:09:04 | 000,021,793 | ---- | M] (AKAI professional M.I. Corp.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\MPD16USB.sys -- (MPD16USB)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\KevBeatzProductionz_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=4081106
IE - HKU\KevBeatzProductionz_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ig/dell?hl=de&client=dell-row&channel=de&ibd=4081106
IE - HKU\KevBeatzProductionz_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\KevBeatzProductionz_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "hxxp://www.web.de/"
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.5: C:\Program Files\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/07/01 11:49:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/07/01 11:49:55 | 000,000,000 | ---D | M]
[2008/11/16 11:23:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\KevBeatzProductionz\AppData\Roaming\Mozilla\Extensions
[2011/08/06 08:10:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\KevBeatzProductionz\AppData\Roaming\Mozilla\Firefox\Profiles\khoxdysj.default\extensions
[2009/11/24 07:56:27 | 000,000,000 | ---D | M] (IObitCom Toolbar) -- C:\Users\KevBeatzProductionz\AppData\Roaming\Mozilla\Firefox\Profiles\khoxdysj.default\extensions\{31c7d459-9cc3-44f2-9dca-fc11795309b4}
[2010/10/24 13:26:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\KevBeatzProductionz\AppData\Roaming\Mozilla\Firefox\Profiles\khoxdysj.default\extensions\{31c7d459-9cc3-44f2-9dca-fc11795309b4}-trash
[2011/04/17 07:17:33 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\KevBeatzProductionz\AppData\Roaming\Mozilla\Firefox\Profiles\khoxdysj.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2008/11/16 11:23:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2009/09/01 21:00:56 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2011/04/30 10:46:48 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/04/30 10:46:48 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011/04/30 10:46:48 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/04/30 10:46:48 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/04/30 10:46:48 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\WLanGUI.exe (AVM Berlin)
O4 - HKLM..\Run: [BambooCore] C:\Program Files\Bamboo Dock\BambooCore.exe ()
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [ECenter] C:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKU\KevBeatzProductionz_ON_C..\Run: [avupdate] C:\Users\KevBeatzProductionz\AppData\Roaming\jashla.exe (Norwalk Johann Nazism Bloomfield Oregon Hendricks)
O4 - HKU\KevBeatzProductionz_ON_C..\Run: [Bamboo Dock] C:\Program Files\Bamboo Dock\Bamboo Dock\Bamboo Dock.exe ()
O4 - HKU\KevBeatzProductionz_ON_C..\Run: [memvate] File not found
O4 - HKU\KevBeatzProductionz_ON_C..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe (Time Information Services Ltd.)
O4 - HKU\KevBeatzProductionz_ON_C..\Run: [PC Suite Tray] C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O4 - HKU\KevBeatzProductionz_ON_C..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
O4 - HKU\KevBeatzProductionz_ON_C..\Run: [SystemData.exe] File not found
O4 - HKU\KevBeatzProductionz_ON_C..\Run: [vegas] File not found
O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O4 - Startup: C:\Users\KevBeatzProductionz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk = C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
O7 - HKU\KevBeatzProductionz_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\KevBeatzProductionz_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: _NoDriveTypeAutoRun = 0
O8 - Extra context menu item: Free YouTube Download - C:\Users\KevBeatzProductionz\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\KevBeatzProductionz\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files\ICQ7.4\ICQ.exe (ICQ, LLC.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{594d0602-94c3-11e0-9b40-001c4af7f174}\Shell - "" = AutoRun
O33 - MountPoints2\{594d0602-94c3-11e0-9b40-001c4af7f174}\Shell\AutoRun\command - "" = F:\RunGame.exe
O33 - MountPoints2\{c51e8c3b-b029-11dd-9cfb-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{c51e8c3b-b029-11dd-9cfb-806e6f6e6963}\Shell\AutoRun\command - "" = F:\pushinst.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\pushinst.exe
O33 - MountPoints2\L\Shell - "" = AutoRun
O33 - MountPoints2\L\Shell\AutoRun\command - "" = L:\reatogoMenu.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011/08/07 07:06:13 | 000,151,552 | ---- | C] (Norwalk Johann Nazism Bloomfield Oregon Hendricks) -- C:\Users\KevBeatzProductionz\AppData\Roaming\jashla.exe
[2011/08/02 16:18:29 | 000,000,000 | ---D | C] -- C:\Users\KevBeatzProductionz\AppData\Local\PunkBuster
[2011/07/30 15:59:31 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/07/28 14:49:20 | 000,000,000 | ---D | C] -- C:\Users\KevBeatzProductionz\Documents\Photoshop
[2011/07/13 05:20:51 | 002,042,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011/07/13 05:20:47 | 000,375,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll
[2011/07/13 05:20:47 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll
[1 C:\Users\KevBeatzProductionz\Documents\*.tmp files -> C:\Users\KevBeatzProductionz\Documents\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/08/07 08:30:45 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/08/07 07:55:49 | 000,038,261 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011/08/07 07:55:49 | 000,038,261 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011/08/07 07:55:36 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/08/07 07:55:36 | 000,000,398 | ---- | M] () -- C:\Windows\tasks\AWC Startup.job
[2011/08/07 07:55:36 | 000,000,276 | ---- | M] () -- C:\Windows\tasks\RtlNICDiagVistaStart.job
[2011/08/07 07:55:33 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/08/07 07:55:33 | 000,003,616 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/08/07 07:21:20 | 000,628,504 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011/08/07 07:21:20 | 000,595,798 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/08/07 07:21:20 | 000,126,248 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011/08/07 07:21:20 | 000,103,872 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/08/07 07:06:13 | 000,151,552 | ---- | M] (Norwalk Johann Nazism Bloomfield Oregon Hendricks) -- C:\Users\KevBeatzProductionz\AppData\Roaming\jashla.exe
[2011/08/07 06:07:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/08/06 18:52:17 | 000,215,040 | ---- | M] () -- C:\Users\KevBeatzProductionz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/08/02 16:18:39 | 000,138,536 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2011/08/02 16:18:33 | 000,270,408 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2011/08/01 16:24:44 | 000,489,777 | ---- | M] () -- C:\Users\KevBeatzProductionz\Documents\FLT_47SUF919270_0 Bahn Ticket.pdf
[2011/07/30 19:55:10 | 007,839,744 | ---- | M] () -- C:\Users\KevBeatzProductionz\Desktop\Edvard Grieg - Banda - Funeral March for Rikard Nordraak - Dallas Wind Symphony, Frederick Fennell.mp3
[2011/07/30 16:03:32 | 006,549,446 | ---- | M] () -- C:\Users\KevBeatzProductionz\Desktop\Mirror's Edge - Still Alive.mp3
[2011/07/30 15:59:31 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/07/30 15:52:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
[2011/07/29 17:26:11 | 000,489,547 | ---- | M] () -- C:\Users\KevBeatzProductionz\Documents\FLT_DN91Z4406_0.pdf
[2011/07/29 11:12:44 | 000,442,501 | ---- | M] () -- C:\Users\KevBeatzProductionz\Documents\FLT_89FPYV626_0 Bahncard Online.pdf
[2011/07/28 13:15:35 | 000,000,741 | ---- | M] () -- C:\Users\KevBeatzProductionz\Desktop\Photoshop CS5 Serials.lnk
[2011/07/24 18:08:57 | 000,000,412 | ---- | M] () -- C:\Windows\tasks\SmartDefrag.job
[2011/07/13 21:22:51 | 003,656,544 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[1 C:\Users\KevBeatzProductionz\Documents\*.tmp files -> C:\Users\KevBeatzProductionz\Documents\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/08/02 16:18:40 | 000,138,536 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2011/08/02 16:18:33 | 000,270,408 | ---- | C] () -- C:\Windows\System32\PnkBstrB.xtr
[2011/08/02 08:05:14 | 000,442,501 | ---- | C] () -- C:\Users\KevBeatzProductionz\Documents\FLT_89FPYV626_0 Bahncard Online.pdf
[2011/08/01 16:24:44 | 000,489,777 | ---- | C] () -- C:\Users\KevBeatzProductionz\Documents\FLT_47SUF919270_0 Bahn Ticket.pdf
[2011/07/30 19:54:42 | 007,839,744 | ---- | C] () -- C:\Users\KevBeatzProductionz\Desktop\Edvard Grieg - Banda - Funeral March for Rikard Nordraak - Dallas Wind Symphony, Frederick Fennell.mp3
[2011/07/30 16:03:18 | 006,549,446 | ---- | C] () -- C:\Users\KevBeatzProductionz\Desktop\Mirror's Edge - Still Alive.mp3
[2011/07/29 17:26:11 | 000,489,547 | ---- | C] () -- C:\Users\KevBeatzProductionz\Documents\FLT_DN91Z4406_0.pdf
[2011/07/22 14:58:18 | 000,000,741 | ---- | C] () -- C:\Users\KevBeatzProductionz\Desktop\Photoshop CS5 Serials.lnk
[2011/07/17 03:43:57 | 005,840,006 | ---- | C] () -- C:\Users\KevBeatzProductionz\Desktop\15 The Traveler.wma
[2011/03/18 11:29:11 | 000,270,408 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2011/03/18 11:29:08 | 000,075,136 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2010/06/10 04:41:40 | 000,038,261 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010/06/10 04:41:40 | 000,038,261 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010/06/10 04:30:09 | 000,000,552 | ---- | C] () -- C:\Users\KevBeatzProductionz\AppData\Local\d3d8caps.dat
[2009/11/29 06:06:59 | 000,000,484 | ---- | C] () -- C:\Windows\eReg.dat
[2009/11/26 06:57:23 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2009/11/23 10:23:49 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll
[2009/09/03 21:38:00 | 000,020,594 | ---- | C] () -- C:\Windows\System32\DELS3L3.DLL
[2008/11/21 17:47:52 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008/11/21 17:44:16 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2008/11/21 10:44:18 | 000,003,140 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2008/11/21 10:44:18 | 000,000,088 | RHS- | C] () -- C:\ProgramData\F9258C6E09.sys
[2008/11/17 18:55:48 | 000,053,248 | ---- | C] () -- C:\Windows\System32\mgxasio2.dll
[2008/11/17 18:49:15 | 000,120,200 | ---- | C] () -- C:\Windows\System32\DLLDEV32i.dll
[2008/11/17 18:48:36 | 000,007,119 | ---- | C] () -- C:\Windows\mgxoschk.ini
[2008/11/13 13:07:35 | 000,765,952 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2008/11/13 13:07:35 | 000,180,224 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2008/11/13 13:07:04 | 000,002,032 | ---- | C] () -- C:\Users\KevBeatzProductionz\AppData\Local\d3d9caps.dat
[2008/11/12 17:14:09 | 000,035,985 | ---- | C] () -- C:\Users\KevBeatzProductionz\AppData\Roaming\NMM-MetaData.db
[2008/11/11 17:38:41 | 000,215,040 | ---- | C] () -- C:\Users\KevBeatzProductionz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/11/11 16:00:25 | 000,097,360 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin
[2008/11/06 01:57:49 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2008/11/06 01:57:49 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008/11/05 18:16:44 | 000,065,536 | ---- | C] () -- C:\Windows\System32\bcmwlrmt.dll
[2008/11/05 18:16:43 | 000,024,064 | ---- | C] () -- C:\Windows\System32\WLTRYSVC.EXE
[2008/02/06 02:51:36 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2008/01/21 03:15:58 | 000,628,504 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008/01/21 03:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008/01/21 03:15:58 | 000,126,248 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008/01/21 03:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2007/10/12 09:34:50 | 000,071,096 | ---- | C] () -- C:\Windows\System32\NMSAccess.exe
[2007/03/29 18:00:40 | 000,203,264 | R--- | C] () -- C:\Windows\System32\CddbCdda.dll
[2006/11/06 15:30:38 | 000,262,144 | ---- | C] () -- C:\Windows\System32\lame_enc.dll
[2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006/11/02 08:47:37 | 003,656,544 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 06:33:01 | 000,595,798 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006/11/02 06:33:01 | 000,103,872 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006/11/02 06:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006/10/21 13:59:59 | 000,262,144 | ---- | C] () -- C:\Windows\System32\Manipulate.dll
[2006/09/24 21:53:56 | 000,268,242 | ---- | C] () -- C:\Windows\System32\erdmpg-parse.dll
[2006/09/24 21:53:44 | 002,518,779 | ---- | C] () -- C:\Windows\System32\erdmpg-enc.dll
[2006/09/24 21:52:06 | 000,030,693 | ---- | C] () -- C:\Windows\System32\erdmpg-int.dll
[2005/11/05 19:34:50 | 000,145,408 | ---- | C] () -- C:\Windows\System32\Lame.exe
[2005/10/14 23:10:24 | 000,065,536 | ---- | C] () -- C:\Windows\System32\comLyricGetter.dll
[2005/05/17 16:37:10 | 000,076,800 | ---- | C] () -- C:\Windows\System32\Faac.exe
[2004/02/01 15:21:56 | 000,097,280 | ---- | C] () -- C:\Windows\System32\Uncommon.dll
[2002/07/19 12:48:22 | 000,157,696 | ---- | C] () -- C:\Windows\System32\OggEnc.exe
========== LOP Check ==========
[2011/05/13 17:03:07 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\Audacity
[2009/06/16 09:44:36 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\DesktopPlayer
[2011/05/22 07:50:59 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\DisneyInteractiveStudios
[2011/07/30 15:52:32 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\DVDVideoSoft
[2011/04/25 12:26:30 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\DVDVideoSoftIEHelpers
[2010/07/01 11:33:33 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\EarMaster
[2009/07/31 12:30:28 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\FX Flat
[2011/08/01 10:37:17 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\ICQ
[2009/11/24 08:37:48 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\IObit
[2009/09/10 06:26:50 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\MAGIX
[2009/06/21 17:15:42 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\Meine Der Herr der Ringe™, Aufstieg des Hexenkönigs™-Dateien
[2009/05/17 05:30:21 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\Meine Die Schlacht um Mittelerde-Dateien
[2009/05/21 16:45:00 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\Meine Die Schlacht um Mittelerde™ II-Dateien
[2009/01/28 16:17:58 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\Nokia
[2008/11/12 17:16:22 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\PC Suite
[2008/11/17 18:59:08 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\ProtectDisc
[2011/03/18 11:29:02 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\PunkBuster
[2011/08/02 16:18:24 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\Ubisoft
[2011/05/23 11:43:12 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\Wacom
[2011/05/23 11:43:14 | 000,000,000 | ---D | M] -- C:\Users\KevBeatzProductionz\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1
[2009/03/29 06:56:54 | 000,000,000 | ---D | M] -- C:\ProgramData\Age of Empires 3
[2008/11/11 15:52:16 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2011/05/23 11:39:30 | 000,000,000 | ---D | M] -- C:\ProgramData\AppData
[2008/11/11 15:52:16 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2008/11/11 15:52:16 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2010/07/01 11:33:33 | 000,000,000 | ---D | M] -- C:\ProgramData\EarMaster
[2008/11/11 15:52:16 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2009/01/04 18:21:10 | 000,000,000 | ---D | M] -- C:\ProgramData\Firefly Studios
[2008/11/12 17:11:44 | 000,000,000 | ---D | M] -- C:\ProgramData\Installations
[2009/09/10 06:22:29 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX
[2008/11/12 17:16:05 | 000,000,000 | ---D | M] -- C:\ProgramData\PC Suite
[2008/11/05 18:30:15 | 000,000,000 | ---D | M] -- C:\ProgramData\PC-Doctor
[2008/11/05 18:30:15 | 000,000,000 | ---D | M] -- C:\ProgramData\PCDr
[2011/05/24 05:48:41 | 000,000,000 | ---D | M] -- C:\ProgramData\regid.1986-12.com.adobe
[2008/11/11 15:52:16 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2008/11/05 18:30:17 | 000,000,000 | ---D | M] -- C:\ProgramData\SupportSoft
[2008/11/24 09:47:40 | 000,000,000 | ---D | M] -- C:\ProgramData\Temp
[2011/03/18 11:53:23 | 000,000,000 | ---D | M] -- C:\ProgramData\Ubisoft
[2008/11/11 15:52:16 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2011/05/23 11:43:15 | 000,000,000 | ---D | M] -- C:\ProgramData\Wacom
[2010/01/09 08:17:09 | 000,000,000 | -H-D | M] -- C:\ProgramData\{29A79E3F-BDD8-48B2-AED0-A6093042EB05}
[2011/08/07 07:55:36 | 000,000,398 | ---- | M] () -- C:\Windows\Tasks\AWC Startup.job
[2011/08/07 07:55:36 | 000,000,276 | ---- | M] () -- C:\Windows\Tasks\RtlNICDiagVistaStart.job
[2011/08/07 07:38:05 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011/07/24 18:08:57 | 000,000,412 | ---- | M] () -- C:\Windows\Tasks\SmartDefrag.job
========== Purity Check ==========
< End of report >
Geändert von Larusso (07.08.2011 um 15:07 Uhr) |
|
09.08.2011, 13:19
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Bundespolizei Trojaner Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)
__________________Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!! Code:
ATTFilter :OTL
O4 - HKU\KevBeatzProductionz_ON_C..\Run: [SystemData.exe] File not found
O4 - HKU\KevBeatzProductionz_ON_C..\Run: [vegas] File not found
O4 - HKU\KevBeatzProductionz_ON_C..\Run: [avupdate] C:\Users\KevBeatzProductionz\AppData\Roaming\jashla.exe (Norwalk Johann Nazism Bloomfield Oregon Hendricks)
O4 - HKU\KevBeatzProductionz_ON_C..\Run: [memvate] File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{594d0602-94c3-11e0-9b40-001c4af7f174}\Shell - "" = AutoRun
O33 - MountPoints2\{594d0602-94c3-11e0-9b40-001c4af7f174}\Shell\AutoRun\command - "" = F:\RunGame.exe
O33 - MountPoints2\{c51e8c3b-b029-11dd-9cfb-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{c51e8c3b-b029-11dd-9cfb-806e6f6e6963}\Shell\AutoRun\command - "" = F:\pushinst.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\pushinst.exe
O33 - MountPoints2\L\Shell - "" = AutoRun
O33 - MountPoints2\L\Shell\AutoRun\command - "" = L:\reatogoMenu.exe
:Files
C:\Users\KevBeatzProductionz\AppData\Roaming\jashla.exe
:Commands
[purity]
[resethosts]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt. Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen: 1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen! 2.) Ordner movedfiles in C:\_OTL in eine Datei zippen 3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html 4.) Wenns erfolgreich war Bescheid sagen 5.) Erst dann wieder den Virenscanner einschalten
__________________ |
|
| Themen zu Bundespolizei Trojaner |
| acedrv05.sys, anmeldung, bundespolizei, bundespolizei trojaner, dateien, gen, heute, hilfe!, jashla.exe, liest, meldung, modus, normale, normalen, nvlddmkm.sys, plug-in, problem, reatogo, sched.exe, start menu, tablet, troja, trojane, trojaner |
Linear-Darstellung
