| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Bundespolizei Trojaner XPWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
08.08.2011, 16:13
| #1 |
| |  Bundespolizei Trojaner XP Hallo, jetzt hat es mich auch erwischt. Ich komm nicht mal im abgesicherten Modus auf den Rechner. Immer nur das Bild Bundespolizei. OTL.TXT OTL Logfile: Code:
ATTFilter OTL logfile created on: 8/8/2011 6:00:55 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINXP | %ProgramFiles% = C:\Programme
Drive C: | 195.31 Gb Total Space | 91.20 Gb Free Space | 46.70% Space Free | Partition Type: NTFS
Drive D: | 39.06 Gb Total Space | 22.75 Gb Free Space | 58.24% Space Free | Partition Type: NTFS
Drive E: | 78.13 Gb Total Space | 20.82 Gb Free Space | 26.65% Space Free | Partition Type: NTFS
Drive F: | 270.44 Gb Total Space | 260.89 Gb Free Space | 96.47% Space Free | Partition Type: NTFS
Drive G: | 109.95 Gb Total Space | 36.64 Gb Free Space | 33.32% Space Free | Partition Type: FAT32
Drive H: | 108.17 Gb Total Space | 23.61 Gb Free Space | 21.83% Space Free | Partition Type: NTFS
Drive I: | 963.70 Mb Total Space | 15.23 Mb Free Space | 1.58% Space Free | Partition Type: FAT
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
========== Win32 Services (SafeList) ==========
SRV - [2011/06/28 12:25:09 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/04/27 03:19:36 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/06/28 03:20:30 | 000,173,352 | ---- | M] (TeamViewer GmbH) [Auto] -- C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe -- (TeamViewer5)
SRV - [2010/03/06 07:16:50 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010/03/04 17:38:00 | 000,071,096 | ---- | M] () [Auto] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccess)
SRV - [2009/08/24 10:51:46 | 000,185,640 | ---- | M] (TeamViewer GmbH) [Auto] -- C:\Programme\TeamViewer\Version4\TeamViewer_Service.exe -- (TeamViewer4)
SRV - [2009/03/31 04:39:36 | 000,233,472 | ---- | M] (Teruten) [Auto] -- C:\WINXP\system32\FsUsbExService.Exe -- (FsUsbExService)
SRV - [2008/09/16 07:03:18 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) [Auto] -- C:\Programme\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor7.0)
SRV - [2008/04/23 22:32:30 | 000,598,016 | ---- | M] () [Auto] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe -- (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM)
SRV - [2008/04/23 22:31:54 | 000,176,128 | ---- | M] () [Auto] -- C:\Programme\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe -- (nSvcIp)
SRV - [2008/04/07 04:17:30 | 000,430,592 | ---- | M] (Nokia.) [On_Demand] -- C:\Programme\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
SRV - [2006/10/26 14:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006/10/26 09:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand] -- -- (WDICA)
DRV - File not found [Kernel | Auto] -- -- (SSPORT)
DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP)
DRV - File not found [Kernel | Auto] -- -- (PCLinkBridge)
DRV - File not found [Kernel | System] -- -- (PCIDump)
DRV - File not found [Kernel | On_Demand] -- -- (NIC2000)
DRV - File not found [Kernel | System] -- -- (lbrtfdc)
DRV - File not found [Kernel | On_Demand] -- -- (IesDrv)
DRV - File not found [Kernel | System] -- -- (i2omgmt)
DRV - File not found [Kernel | System] -- -- (Changer)
DRV - [2011/06/28 12:25:09 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINXP\system32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/06/28 12:25:09 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\WINXP\system32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/03/11 05:17:14 | 000,025,088 | ---- | M] (TeamViewer GmbH) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\teamviewervpn.sys -- (teamviewervpn)
DRV - [2009/11/12 08:48:56 | 000,005,504 | ---- | M] () [File_System | Auto] -- C:\WINXP\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2009/09/24 18:59:35 | 000,104,512 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\AnyDVD.sys -- (AnyDVD)
DRV - [2009/09/23 18:59:26 | 004,481,024 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2009/08/19 08:05:56 | 000,100,368 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2009/05/11 03:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINXP\system32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009/03/31 04:39:36 | 000,036,608 | ---- | M] () [Kernel | On_Demand] -- C:\WINXP\system32\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2009/03/20 05:01:26 | 000,121,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\ss_bmdm.sys -- (ss_bmdm)
DRV - [2009/03/20 05:01:26 | 000,090,112 | ---- | M] (MCCI) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM)
DRV - [2009/03/20 05:01:26 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter)
DRV - [2009/02/13 06:35:01 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio)
DRV - [2008/11/04 01:54:00 | 000,078,848 | R--- | M] () [Kernel | On_Demand] -- C:\WINXP\system32\drivers\snxppalx.sys -- (SNXPPALX)
DRV - [2008/11/04 01:54:00 | 000,017,536 | R--- | M] () [Kernel | On_Demand] -- C:\WINXP\system32\drivers\snxpcard.sys -- (SNXPCARD)
DRV - [2008/10/31 06:38:08 | 004,942,336 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008/03/24 23:48:08 | 000,022,016 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2008/03/24 23:48:06 | 000,054,400 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\NVENETFD.sys -- (NVENETFD)
DRV - [2008/02/15 03:15:26 | 000,014,336 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\nvsmu.sys -- (nvsmu)
DRV - [2007/09/17 10:53:26 | 000,021,632 | ---- | M] (Nokia) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\pccsmcfd.sys -- (pccsmcfd)
DRV - [2007/04/16 11:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System] -- C:\WINXP\system32\drivers\AmdPPM.sys -- (AmdPPM)
DRV - [2005/11/30 12:42:30 | 000,041,984 | ---- | M] (DeviceGuys, Inc.) [Kernel | Auto] -- C:\WINXP\system32\drivers\DgivEcp.sys -- (DgiVecp)
DRV - [2005/04/29 20:52:24 | 000,037,708 | ---- | M] () [Kernel | On_Demand] -- C:\WINXP\system32\drivers\ulink.sys -- (Usblink)
DRV - [2002/02/27 07:49:08 | 000,018,331 | R--- | M] (KOBIL Systems) [Kernel | On_Demand] -- C:\WINXP\system32\drivers\KOBUSB2K.sys -- (KOBUSB2K)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Ingo_ON_C\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm
IE - HKU\Ingo_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.selectedEngine: "Amazon.de"
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINXP\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINXP\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Programme\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011/06/29 12:20:50 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011/04/19 10:01:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Components: C:\Programme\Mozilla Thunderbird\components [2011/06/29 02:22:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.11\extensions\\Plugins: C:\Programme\Mozilla Thunderbird\plugins
[2010/02/20 09:14:19 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\mozilla\Extensions
[2010/02/20 09:14:19 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2011/07/28 07:17:15 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\mozilla\Firefox\Profiles\7oe7qjtz.default\extensions
[2011/07/28 07:17:15 | 000,000,000 | ---D | M] (FoxyTunes) -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\mozilla\Firefox\Profiles\7oe7qjtz.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}
[2011/04/18 13:17:09 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010/08/30 06:02:11 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
File not found (No name found) --
() (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\INGO\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\7OE7QJTZ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2010/02/20 13:57:00 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/06/29 12:20:49 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2010/07/16 23:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2011/04/19 10:01:33 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/04/19 10:01:33 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2011/04/19 10:01:33 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011/04/19 10:01:33 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/04/19 10:01:33 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/04/19 10:01:33 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2010/03/06 07:23:21 | 000,001,375 | ---- | M]) - C:\WINXP\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate.adobe.com:443
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 192.150.18.108
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKU\Ingo_ON_C\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Alcmtr] C:\WINXP\ALCMTR.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [NPSStartup] File not found
O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [WHITNEY_S2P] C:\Programme\Samsung\Samsung SCX-4x21 Series\PSU\Scan2pc.exe ()
O4 - HKU\Ingo_ON_C..\Run: [ASRockIES] C:\Programme\ASRock Utility\IES\AsrIes.exe (ASRock)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Ingo_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKU\Ingo_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\Ingo_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutorunSetting = 1
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINXP\system32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINXP\system32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINXP\system32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINXP\system32\nvLsp.dll (NVIDIA)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\jashla.exe) - C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\jashla.exe (aIKf)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINXP\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINXP\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINXP\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/20 07:34:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2004/11/02 05:28:01 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2008/03/21 10:13:03 | 000,000,050 | ---- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011/08/08 07:54:25 | 000,000,000 | --SD | C] -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Microsoft
[2011/08/08 07:54:25 | 000,000,000 | --SD | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft
[2011/08/08 07:54:25 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Administrator\SendTo
[2011/08/08 07:54:25 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten
[2011/08/08 07:54:25 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Zubehör
[2011/08/08 07:54:25 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Administrator\Startmenü
[2011/08/08 07:54:25 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart
[2011/08/08 07:54:25 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\Administrator\IETldCache
[2011/08/08 07:54:25 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen\Administrator\Cookies
[2011/08/08 07:54:25 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Administrator\Vorlagen
[2011/08/08 07:54:25 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Administrator\Recent
[2011/08/08 07:54:25 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Administrator\Netzwerkumgebung
[2011/08/08 07:54:25 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen
[2011/08/08 07:54:25 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Administrator\Druckumgebung
[2011/08/08 07:54:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Favoriten
[2011/08/08 07:54:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Desktop
[2011/08/08 07:54:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\Adobe
[2011/08/08 07:54:21 | 000,000,000 | ---D | C] -- C:\WINXP\CSC
[2011/08/08 06:25:09 | 000,232,448 | ---- | C] (aIKf) -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\jashla.exe
[1996/11/17 16:00:00 | 000,018,944 | ---- | C] ( ) -- C:\WINXP\System32\IMPLODE.DLL
[1 C:\WINXP\System32\*.tmp files -> C:\WINXP\System32\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011/08/08 10:39:07 | 000,002,048 | --S- | M] () -- C:\WINXP\bootstat.dat
[2011/08/08 06:30:56 | 000,002,206 | ---- | M] () -- C:\WINXP\System32\wpa.dbl
[2011/08/08 06:25:09 | 000,232,448 | ---- | M] (aIKf) -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\jashla.exe
[2011/08/01 07:18:51 | 000,003,072 | ---- | M] () -- C:\DTAUS0
[2011/07/31 10:31:51 | 000,090,752 | ---- | M] () -- C:\DTAUS1
[2011/07/18 05:35:09 | 000,039,334 | ---- | M] () -- H:\Eigene Dateien\11831763244cf6a468a3a8.pdf
[2011/07/15 02:51:50 | 000,033,892 | ---- | M] () -- H:\Eigene Dateien\0711final.pdf
[2011/07/14 05:50:05 | 000,032,357 | ---- | M] () -- H:\Eigene Dateien\0711.pdf
[2011/07/14 03:55:08 | 000,002,499 | ---- | M] () -- C:\Dokumente und Einstellungen\Ingo\Desktop\Microsoft Office Word 2007.lnk
[1 C:\WINXP\System32\*.tmp files -> C:\WINXP\System32\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011/08/08 07:54:26 | 000,001,587 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Remoteunterstützung.lnk
[2011/08/08 07:54:26 | 000,000,764 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Windows Media Player.lnk
[2011/07/18 05:35:08 | 000,039,334 | ---- | C] () -- H:\Eigene Dateien\11831763244cf6a468a3a8.pdf
[2011/07/15 02:51:50 | 000,033,892 | ---- | C] () -- H:\Eigene Dateien\0711final.pdf
[2011/07/14 05:50:04 | 000,032,357 | ---- | C] () -- H:\Eigene Dateien\0711.pdf
[2011/02/07 11:37:13 | 000,177,024 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
[2010/12/07 08:07:40 | 000,000,040 | -HS- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\.zreglib
[2010/10/31 12:00:58 | 000,045,843 | ---- | C] () -- C:\WINXP\CSTBox.INI
[2010/07/16 04:41:32 | 000,000,093 | ---- | C] () -- C:\WINXP\System32\GATWriter5250ocx.ini
[2010/03/14 03:58:15 | 000,110,592 | ---- | C] () -- C:\WINXP\System32\FsUsbExDevice.Dll
[2010/03/14 03:58:15 | 000,036,608 | ---- | C] () -- C:\WINXP\System32\FsUsbExDisk.Sys
[2010/03/14 03:58:07 | 000,002,528 | ---- | C] () -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\$_hpcst$.hpc
[2010/03/04 15:36:15 | 000,002,963 | ---- | C] () -- C:\WINXP\cdplayer.ini
[2010/03/03 10:49:32 | 000,078,848 | R--- | C] () -- C:\WINXP\System32\drivers\snxppalx.sys
[2010/03/03 10:49:32 | 000,054,912 | R--- | C] () -- C:\WINXP\System32\drivers\snxpserx.sys
[2010/03/03 10:49:32 | 000,017,536 | R--- | C] () -- C:\WINXP\System32\drivers\snxpcard.sys
[2010/03/03 10:49:31 | 000,027,136 | R--- | C] () -- C:\WINXP\System32\snxprops.dll
[2010/02/27 08:51:06 | 000,037,708 | ---- | C] () -- C:\WINXP\System32\drivers\ulink.sys
[2010/02/27 08:51:06 | 000,005,406 | ---- | C] () -- C:\WINXP\System32\drivers\M5633.bin
[2010/02/23 08:02:07 | 000,039,095 | ---- | C] () -- C:\WINXP\iccsigs.dat
[2010/02/23 08:02:06 | 000,112,688 | ---- | C] () -- C:\WINXP\System32\shw32.dll
[2010/02/21 05:17:46 | 000,172,032 | ---- | C] () -- C:\WINXP\System32\RTF4COM.dll
[2010/02/21 05:17:46 | 000,167,936 | ---- | C] () -- C:\WINXP\System32\RTF4DLL.dll
[2010/02/21 05:17:45 | 000,217,088 | ---- | C] () -- C:\WINXP\System32\LPng.dll
[2010/02/21 05:17:45 | 000,001,214 | ---- | C] () -- C:\WINXP\System32\IDD.dat
[2010/02/21 04:57:53 | 000,000,021 | ---- | C] () -- C:\WINXP\KurusDeinstall.INI
[2010/02/20 15:46:38 | 000,099,840 | ---- | C] () -- C:\Dokumente und Einstellungen\Ingo\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/20 15:30:17 | 000,007,854 | ---- | C] () -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\SmarThruOptions.xml
[2010/02/20 15:30:00 | 000,090,112 | ---- | C] () -- C:\WINXP\System32\SamFaxPort.dll
[2010/02/20 15:29:52 | 000,000,111 | ---- | C] () -- C:\WINXP\Readiris.ini
[2010/02/20 15:29:49 | 000,023,040 | ---- | C] () -- C:\WINXP\System32\irisco32.dll
[2010/02/20 15:28:10 | 000,479,232 | ---- | C] () -- C:\WINXP\ssndii.exe
[2010/02/20 15:26:19 | 000,110,592 | R--- | C] () -- C:\WINXP\WiaInst.exe
[2010/02/20 15:24:00 | 000,094,208 | R--- | C] () -- C:\WINXP\System32\WIAIPH.dll
[2010/02/20 15:24:00 | 000,049,152 | R--- | C] () -- C:\WINXP\System32\WIASTIIO.dll
[2010/02/20 15:23:59 | 000,086,016 | R--- | C] () -- C:\WINXP\System32\WIAEH.dll
[2010/02/20 15:23:59 | 000,049,152 | R--- | C] () -- C:\WINXP\System32\Sswiadrv.dll
[2010/02/20 15:04:42 | 001,064,960 | ---- | C] () -- C:\WINXP\System32\MGIIpl2PX.dll
[2010/02/20 15:04:42 | 000,332,800 | ---- | C] () -- C:\WINXP\System32\FPXLIB.DLL
[2010/02/20 15:04:42 | 000,122,880 | ---- | C] () -- C:\WINXP\System32\JPEGLIB.DLL
[2010/02/20 15:04:42 | 000,020,480 | ---- | C] () -- C:\WINXP\System32\MGIIpl2.dll
[2010/02/20 15:04:42 | 000,019,968 | ---- | C] () -- C:\WINXP\System32\CPUINF32.DLL
[2010/02/20 15:04:41 | 001,265,664 | ---- | C] () -- C:\WINXP\System32\MGIIpl2A6.dll
[2010/02/20 15:04:41 | 001,228,800 | ---- | C] () -- C:\WINXP\System32\MGIIpl2M6.dll
[2010/02/20 15:04:41 | 001,200,128 | ---- | C] () -- C:\WINXP\System32\MGIIpl2M5.dll
[2010/02/20 15:04:41 | 001,073,152 | ---- | C] () -- C:\WINXP\System32\MGIIpl2P6.dll
[2010/02/20 15:04:41 | 001,028,096 | ---- | C] () -- C:\WINXP\System32\MGIIpl2P5.dll
[2010/02/20 15:04:41 | 000,000,002 | ---- | C] () -- C:\WINXP\PhotoSuite.ini
[2010/02/20 14:59:12 | 000,000,141 | ---- | C] () -- C:\WINXP\DEINSTAL.INI
[2010/02/20 14:27:46 | 000,000,021 | ---- | C] () -- C:\WINXP\DvInesKurusOleServer002.INI
[2010/02/20 14:27:30 | 000,000,095 | ---- | C] () -- C:\WINXP\dvinesinstart001.INI
[2010/02/20 14:27:30 | 000,000,095 | ---- | C] () -- C:\WINXP\dvinesinstalllocation001.INI
[2010/02/20 14:27:27 | 000,000,021 | ---- | C] () -- C:\WINXP\Startup.INI
[2010/02/20 14:23:26 | 000,004,073 | ---- | C] () -- C:\WINXP\ODBCINST.INI
[2010/02/20 14:22:13 | 000,325,112 | ---- | C] () -- C:\WINXP\System32\FNTCACHE.DAT
[2010/02/20 09:12:18 | 000,000,000 | ---- | C] () -- C:\WINXP\nsreg.dat
[2010/02/20 08:11:41 | 000,000,450 | ---- | C] () -- C:\WINXP\hbcikrnl.ini
[2010/02/20 07:49:21 | 000,003,948 | R--- | C] () -- C:\WINXP\System32\drivers\nvphy.bin
[2010/02/20 07:48:10 | 000,004,995 | ---- | C] () -- C:\WINXP\Ascd_tmp.ini
[2010/02/20 07:48:06 | 000,010,288 | ---- | C] () -- C:\WINXP\System32\drivers\ASUSHWIO.SYS
[2010/02/20 07:46:54 | 000,000,000 | ---- | C] () -- C:\WINXP\ativpsrm.bin
[2010/02/20 07:41:22 | 000,593,920 | ---- | C] () -- C:\WINXP\System32\ati2sgag.exe
[2010/02/20 07:41:11 | 000,887,724 | R--- | C] () -- C:\WINXP\System32\ativva6x.dat
[2010/02/20 07:41:11 | 000,195,855 | R--- | C] () -- C:\WINXP\System32\atiicdxx.dat
[2010/02/20 07:41:11 | 000,000,003 | R--- | C] () -- C:\WINXP\System32\ativva5x.dat
[2010/02/20 07:36:53 | 000,002,048 | --S- | C] () -- C:\WINXP\bootstat.dat
[2010/02/20 07:31:52 | 000,021,740 | ---- | C] () -- C:\WINXP\System32\emptyregdb.dat
[2010/02/02 15:19:20 | 000,453,024 | ---- | C] () -- C:\Programme\setup.exe
[2010/02/02 15:18:14 | 010,182,144 | ---- | C] () -- C:\Programme\openofficeorg32.msi
[2010/02/02 15:18:10 | 146,492,804 | ---- | C] () -- C:\Programme\openofficeorg1.cab
[2010/02/01 19:28:52 | 000,000,290 | ---- | C] () -- C:\Programme\setup.ini
[2009/02/18 13:55:20 | 000,294,912 | ---- | C] () -- C:\WINXP\System32\ATIODE.exe
[2009/02/03 16:52:02 | 000,045,056 | ---- | C] () -- C:\WINXP\System32\ATIODCLI.exe
[2008/04/14 05:00:00 | 013,107,200 | ---- | C] () -- C:\WINXP\System32\oembios.bin
[2008/04/14 05:00:00 | 000,673,088 | ---- | C] () -- C:\WINXP\System32\mlang.dat
[2008/04/14 05:00:00 | 000,452,310 | ---- | C] () -- C:\WINXP\System32\perfh007.dat
[2008/04/14 05:00:00 | 000,435,396 | ---- | C] () -- C:\WINXP\System32\perfh009.dat
[2008/04/14 05:00:00 | 000,272,128 | ---- | C] () -- C:\WINXP\System32\perfi009.dat
[2008/04/14 05:00:00 | 000,269,480 | ---- | C] () -- C:\WINXP\System32\perfi007.dat
[2008/04/14 05:00:00 | 000,218,003 | ---- | C] () -- C:\WINXP\System32\dssec.dat
[2008/04/14 05:00:00 | 000,081,124 | ---- | C] () -- C:\WINXP\System32\perfc007.dat
[2008/04/14 05:00:00 | 000,068,292 | ---- | C] () -- C:\WINXP\System32\perfc009.dat
[2008/04/14 05:00:00 | 000,046,258 | ---- | C] () -- C:\WINXP\System32\mib.bin
[2008/04/14 05:00:00 | 000,034,478 | ---- | C] () -- C:\WINXP\System32\perfd007.dat
[2008/04/14 05:00:00 | 000,028,626 | ---- | C] () -- C:\WINXP\System32\perfd009.dat
[2008/04/14 05:00:00 | 000,004,569 | ---- | C] () -- C:\WINXP\System32\secupd.dat
[2008/04/14 05:00:00 | 000,004,463 | ---- | C] () -- C:\WINXP\System32\oembios.dat
[2008/04/14 05:00:00 | 000,001,804 | ---- | C] () -- C:\WINXP\System32\Dcache.bin
[2008/04/14 05:00:00 | 000,000,741 | ---- | C] () -- C:\WINXP\System32\noise.dat
[2007/10/25 12:26:10 | 000,005,504 | ---- | C] () -- C:\WINXP\System32\drivers\StarOpen.sys
[1999/04/26 16:00:00 | 000,377,856 | ---- | C] () -- C:\WINXP\System32\tx32.dll
[1999/02/11 18:21:00 | 000,000,151 | ---- | C] () -- C:\WINXP\System32\IC32.INI
[1996/11/17 19:00:00 | 000,036,352 | ---- | C] () -- C:\WINXP\System32\P2BBND.DLL
[1996/11/17 16:00:00 | 000,748,160 | ---- | C] () -- C:\WINXP\System32\CO2C40EN.DLL
========== LOP Check ==========
[2011/04/06 05:39:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\Avery
[2010/11/16 11:59:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\Azureus
[2010/12/07 07:01:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\Canneverbe Limited
[2010/10/31 12:14:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\Canon
[2010/02/20 15:36:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\CD-LabelPrint
[2010/04/16 10:55:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\GARMIN
[2010/02/26 07:40:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\ImgBurn
[2010/02/20 13:58:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\OpenOffice.org
[2011/05/10 11:04:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\Opera
[2010/03/14 04:13:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\PC Suite
[2010/03/04 08:18:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\PixelPlanet
[2010/08/31 11:07:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\Samsung
[2010/02/20 15:30:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\SmarThru4
[2010/06/30 09:21:25 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\TeamViewer
[2010/02/20 09:14:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\Thunderbird
[2010/03/21 13:32:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Azureus
[2010/12/07 07:01:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited
[2010/02/20 15:09:37 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ
[2010/04/16 09:19:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GARMIN
[2010/03/14 04:13:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
[2010/03/04 08:18:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PixelPlanet
[2010/12/07 08:07:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SlySoft
========== Purity Check ==========
< End of report >
EXTRA.TXT OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 8/8/2011 6:00:55 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINXP | %ProgramFiles% = C:\Programme
Drive C: | 195.31 Gb Total Space | 91.20 Gb Free Space | 46.70% Space Free | Partition Type: NTFS
Drive D: | 39.06 Gb Total Space | 22.75 Gb Free Space | 58.24% Space Free | Partition Type: NTFS
Drive E: | 78.13 Gb Total Space | 20.82 Gb Free Space | 26.65% Space Free | Partition Type: NTFS
Drive F: | 270.44 Gb Total Space | 260.89 Gb Free Space | 96.47% Space Free | Partition Type: NTFS
Drive G: | 109.95 Gb Total Space | 36.64 Gb Free Space | 33.32% Space Free | Partition Type: FAT32
Drive H: | 108.17 Gb Total Space | 23.61 Gb Free Space | 21.83% Space Free | Partition Type: NTFS
Drive I: | 963.70 Mb Total Space | 15.23 Mb Free Space | 1.58% Space Free | Partition Type: FAT
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Opera.HTML] -- C:\Programme\Opera\Opera.exe (Opera Software)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
http [open] -- "C:\Programme\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Programme\Opera\Opera.exe" "%1" (Opera Software)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"E:\downloads\Worms 4 Mayhem\www.TorrentSource.TO_Worms.4.Mayhem.Multi-TECHNiC\WORMS 4 MAYHEM.EXE" = E:\downloads\Worms 4 Mayhem\www.TorrentSource.TO_Worms.4.Mayhem.Multi-TECHNiC\WORMS 4 MAYHEM.EXE:*:Enabled:Worms 4 Mayhem -- (Team 17 Ltd)
"C:\Programme\java\jre6\bin\javaw.exe" = C:\Programme\java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\SML\SML.exe" = C:\SML\SML.exe:*:Enabled:SML
"C:\Programme\Gemeinsame Dateien\XPressUpdate\XPressUpdate.exe" = C:\Programme\Gemeinsame Dateien\XPressUpdate\XPressUpdate.exe:*:Enabled:XPressUpdate
"C:\Programme\Samsung\Samsung New PC Studio\npsasvr.exe" = C:\Programme\Samsung\Samsung New PC Studio\npsasvr.exe:*:Enabled:KTF MUSIC AoD Server -- (PeeringPortal)
"C:\Programme\Samsung\Samsung New PC Studio\npsvsvr.exe" = C:\Programme\Samsung\Samsung New PC Studio\npsvsvr.exe:*:Enabled:KTF MUSIC VoD Server -- (PeeringPortal)
"C:\Programme\TeamViewer\Version4\TeamViewer.exe" = C:\Programme\TeamViewer\Version4\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\Azureus\Azureus.exe" = C:\Programme\Azureus\Azureus.exe:*:Enabled:Azureus -- (Vuze Inc.)
"C:\Programme\TeamViewer\Version5\TeamViewer.exe" = C:\Programme\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\Opera\opera.exe" = C:\Programme\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0269EABA-E967-A5B1-AE1C-BE6B49FE50C4}" = CCC Help Russian
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{0733FDFA-C6F8-68FC-C11F-B53A5C366B87}" = CCC Help Korean
"{0C718114-0B93-F91E-C7AA-AF64E836FEE9}" = CCC Help Hungarian
"{10974DAA-1BD9-36C1-153E-836C60941B54}" = CCC Help Chinese Standard
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP4600_series" = Canon iP4600 series Printer Driver
"{143FB15C-0C48-41E3-9C30-F56FB69BF3D7}" = Canon CanoScan Toolbox 4.5
"{16EABAE2-7356-3520-B400-C6D7E133F36F}" = Catalyst Control Center Graphics Full Existing
"{17709A6F-C5F4-5E1F-EFED-00A79840E6F1}" = CCC Help Norwegian
"{192A107E-C6B9-41B9-BDBF-38E3AA226054}" = OpenOffice.org 3.2
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FF713E1-FE5E-4AD0-9C8C-B2E877846B45}" = Catalyst Control Center - Branding
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java(TM) 6 Update 21
"{27016060-549E-EBB8-4887-8DA93A1264BD}" = CCC Help Japanese
"{2F4BDBA6-B6AA-B282-18E5-6566154131D3}" = ccc-utility
"{328019A7-0012-401D-96A2-4CDDD02675A8}" = Garmin POI Loader
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3CA9D105-113C-11D8-AB3E-000102B0F79A}" = Readiris Pro 9
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5202DAAF-302E-4A05-3F5D-E3A84FD3CED2}" = Catalyst Control Center Graphics Light
"{527E23D5-03F6-F17C-9237-C501B89F1B2D}" = Catalyst Control Center HydraVision Full
"{5738FED6-70B0-0002-89C0-B011961F4727}" = CCC Help Finnish
"{57AD741D-AD0B-1AE3-C4B9-26808FB82A8F}" = CCC Help Czech
"{5AFF8239-4ACC-DA98-810D-B586AC1BAB1C}" = CCC Help Italian
"{5D3DC7BE-4387-19C9-1662-C8BC54603C7D}" = CCC Help Polish
"{5DA6F06A-B389-407B-BF8C-1548767914D8}" = ATI Problem Report Wizard
"{629D5194-336E-803C-8932-2614F1E0AAD1}" = Catalyst Control Center Core Implementation
"{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers
"{6693C57D-1EA3-639F-FE81-6B36487C3501}" = CCC Help Thai
"{72A579CD-7AA7-4850-A81B-54B300F40965}" = KOBIL-Kartenlesersoftware
"{73959E48-36BA-E993-D782-2EC6BE0FED2C}" = CCC Help Spanish
"{75DBC9CD-2FDC-6215-2A77-E62766ADB1B0}" = CCC Help Danish
"{7B168F60-2925-502D-0CF2-6A5C1D1AB008}" = CCC Help Portuguese
"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver
"{802213F3-C599-4F13-B152-326107DC199F}" = CCC Help Swedish
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90F1943D-EA4A-4460-B59F-30023F3BA69A}" = SmarThru 4
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A5EF92F2-2155-28FF-F9A0-5BD93980FD9E}" = CCC Help English
"{A69BCB96-18D1-A749-038F-888FB3CAF767}" = CCC Help Turkish
"{A7BA5663-08FD-41B1-8008-DD3C3752C2E5}" = Garmin City Navigator Europe NT 2010.20 Update
"{AB67580-257C-45FF-B8F4-C8C30682091A}_is1" = SIW version 2010.02.10
"{AB7A2001-6956-B1B6-9675-91D55DF4FF1C}" = Catalyst Control Center Graphics Full New
"{AC250666-8F96-C1BD-BDF3-9F56116EC079}" = CCC Help Dutch
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-1033-F400-7761-000000000004}_934" = Adobe Acrobat 9.3.4 - CPSID_83708
"{AC76BA86-1033-F400-7761-000000000004}{AC76BA86-1033-F400-7761-000000000004}" = Adobe Acrobat 9 Pro Extended - English, Français, Deutsch
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer
"{B388231D-672A-4169-A3DF-BD80266252AB}" = StarMoney
"{B7F787D1-2974-4143-9EDD-B4FA30B08204}" = StarMoney 6.0
"{B88D63E8-C435-EA92-9327-F6041C9929D5}" = ccc-core-static
"{BB7DADFA-4AC0-D6FA-0077-5E1F0DB8E9D5}" = Catalyst Control Center Localization All
"{BFCD0739-ED6C-8C2D-98CC-DC0CC9014DC1}" = ccc-core-preinstall
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C2C3BC8C-B268-34C9-DFAE-DF61577E7BCC}" = CCC Help German
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{CB6075D9-F912-40AE-BEA6-E590DA24F16B}" = Adobe Photoshop Elements 7.0
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E9DE0715-A9BB-4F02-AD4C-D1545C8E986F}" = ATI AVIVO Codecs
"{EAC54211-5600-B674-058D-DC4C23E582AD}" = CCC Help Chinese Traditional
"{EC5054B2-2D1C-7BBC-535B-588F2E8F27D6}" = Catalyst Control Center Graphics Previews Common
"{F10B0FE9-B749-9C9A-2705-2E95691152DF}" = CCC Help French
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"{F97272B4-82C4-46B2-BCF1-C4D6E8CAB3E6}" = Avery Wizard 4.0
"{FE0DB7F6-7A77-05D9-7A8C-A3545E95232C}" = CCC Help Greek
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Windows-Treiberpaket - Nokia pccsmcfd (10/12/2007 6.85.4.0)
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"6194C28A8F62DD817EA1B918E6E46E806A21B452" = Windows-Treiberpaket - MobileTop (sshpmdm) Modem (02/23/2007 2.5.0.0)
"65B6FE5418CE28F4D72543FB2D964C3CEC83F161" = Windows-Treiberpaket - MobileTop (sshpusb) USB (02/23/2007 2.5.0.0)
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 7" = Adobe Photoshop Elements 7.0
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"AnyDVD" = AnyDVD
"ASRock IES_is1" = ASRock IES
"ASRock InstantBoot_is1" = ASRock InstantBoot
"ATI Display Driver" = ATI Display Driver
"Audiograbber" = Audiograbber 1.83 SE
"Audiograbber-Lame" = Audiograbber Lame-MP3-Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Canon iP4600 series Benutzerregistrierung" = Canon iP4600 series Benutzerregistrierung
"CanonMyPrinter" = Canon Utilities My Printer
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CCleaner" = CCleaner
"Corel Applications" = Corel Applications
"DATEVT00000801.0" = DATEV Kassenerfassung für Office V.1.23
"DF CrcSfv_is1" = DF CrcSfv 1.3
"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX
"ENTERPRISE" = Microsoft Office Enterprise 2007
"FoxyTunesForFirefox" = FoxyTunes for Firefox
"ImgBurn" = ImgBurn
"InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"InstallShield_{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer
"InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"MGI_PRISM_V1_0" = MGI PhotoSuite II SE (nur entfernen)
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 5.0 (x86 de)" = Mozilla Firefox 5.0 (x86 de)
"Mozilla Thunderbird (3.1.11)" = Mozilla Thunderbird (3.1.11)
"NVIDIA Drivers" = NVIDIA Drivers
"Opera 11.11.2109" = Opera 11.11
"SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software
"SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set
"Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software
"Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software
"SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software
"SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software
"Samsung SCX-4x21 Series" = Samsung SCX-4x21 Series
"SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software
"SmarThru PC Fax" = SmarThru PC Fax
"TeamViewer 4" = TeamViewer 4
"TeamViewer 5" = TeamViewer 5
"VLC media player" = VLC media player 1.0.5
"WinRAR archiver" = WinRAR
"xp-AntiSpy" = xp-AntiSpy 3.97-9
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
< End of report >
Was kann ich tun, damit der Rechner wieder läuft? Vielen Dank für die Hilfe! VG Ingo |
|
09.08.2011, 20:51
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Bundespolizei Trojaner XP Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)
__________________Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!! Code:
ATTFilter :OTL
O20 - HKLM Winlogon: Shell - (C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\jashla.exe) - C:\Dokumente und Einstellungen\Ingo\Anwendungsdaten\jashla.exe (aIKf)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/20 07:34:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2004/11/02 05:28:01 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2008/03/21 10:13:03 | 000,000,050 | ---- | M] () - E:\AUTOEXEC.BAT -- [ NTFS ]
:Commands
[purity]
[resethosts]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt. Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen: 1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen! 2.) Ordner movedfiles in C:\_OTL in eine Datei zippen 3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html 4.) Wenns erfolgreich war Bescheid sagen 5.) Erst dann wieder den Virenscanner einschalten
__________________ |
|
10.08.2011, 10:58
| #3 |
| | Bundespolizei Trojaner XP Hallo,
__________________hat super funktioniert. Vielen Dank!!! Ich kann den Rechner wieder starten. Den Ordner movedfiles hab ich hochgeladen. Ich hab jetzt das Gefühl, dass der Rechner etwas lahm ist. Kann das sein? Ich werde ihn neu machen. Worauf muss ich bei einer Datensicherung achten. Nicht, dass ich noch irgendwo was Verstecktes habe. VG Ingo |
|
10.08.2011, 11:15
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Bundespolizei Trojaner XPZitat:
Hier eine kurze Anleitung zu PartedMagic, funktioniert prinzipell so aber fast genauso mit allen anderen Live-Systemen auch. 1. Lade Dir das ISO-Image von PartedMagic herunter, müssten ca. 180 MB sein 2. Brenn es per Imagebrennfunktion auf CD, geht zB mit ImgBurn unter Windows 3. Boote von der gebrannten CD, im Bootmenü von Option 1 starten und warten bis der Linux-Desktop oben ist  4. Du müsstest ein Symbol "Mount Devices" finden, das doppelklicken 5. Mounte die Partitionen wo Windows installiert ist, meistens isses /dev/sda1 und natürlich noch etwaige andere Partitionen, wo noch Daten liegen und die gesichert werden müssen - natürlich auch die der externen Platte (du bekommmst nur Lese- und Schreibzugriffe auf die Dateisysteme, wenn diese gemountet sind) 6. Kopiere die Daten der internen Platte auf die externe Platte - kopiere nur persönliche Dateien, Musik, Videos, etc. auf die Backupplatte, KEINE ausführbaren Dateien wie Programme/Spiele/Setups!! 7. Wenn fertig, starte den Rechner neu, schalte die ext. Platte ab und boote von der Windows-DVD zur Neuinstallation (Anleitung beachten)
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
| Themen zu Bundespolizei Trojaner XP |
| .com, 0x00000001, antivir, audiograbber, avira, benutzerregistrierung, bho, cdburnerxp, desktop, entfernen, error, excel, firefox, flash player, fontcache, format, helper, internet browser, jashla.exe, logfile, microsoft office word, mozilla thunderbird, plug-in, problem, realtek, reatogo, registry, remote control, rundll, scan, sched.exe, security, shell32.dll, software, studio, trojaner, udp, windows, windows xp |
Linear-Darstellung
