|
Plagegeister aller Art und deren Bekämpfung: Hilfe bundespolizei trojaner !!!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
19.08.2011, 06:40 | #1 |
| Hilfe bundespolizei trojaner !!! tag zusammen ich brauche dringend hilfe von euch profis unzwar habe ich auf mein laptop ein miesen trojaner wenn ich den rechner hochfahre kommt immer ein pop-up wo drin steht , das ich 100 euro bezahlen muss etc. da steht auch groß bundespolizei. ich hab auch schon kaspersky rescue cd ausprobiert, ich hab das 3 mal durchscannen lassen aber da gabs immer 0 funde. und jetzt geht irgendwie auch garnix mehr. ich fahr den rechner hoch dan komme ich zu der einstellung windows normal starten , windows in abgesicherten modus starten, wenn ich da was drücke passiert nix und der rechner fährt wieder neu hoch. brauche da dringend hilfe weil ich da nicht allzuviel ahnung habe. wäre sehr dankbar wenn ihr mir helfen würdert grüße |
19.08.2011, 06:59 | #2 | ||
/// Helfer-Team | Hilfe bundespolizei trojaner !!! Hallo und Herzlich Willkommen!
__________________Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]: Zitat:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen! Unbootbares System mit OTLPE Network scannen Unbootbares System mit OTLPE Network scannen
ISOBurner Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD. Zitat:
kira
__________________ |
19.08.2011, 16:57 | #3 |
| Hilfe bundespolizei trojaner !!! danke schonmal das du mir helfen willst
__________________also ich hab alles befolgt wie es da steht aber ich kriege nur die OTL.Txt datei ich stell die mal rein Code:
ATTFilter Internet Explorer (Version = 8.0.6001.19088) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free 3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 34.18 Gb Total Space | 0.53 Gb Free Space | 1.56% Space Free | Partition Type: NTFS Drive E: | 263.91 Gb Total Space | 263.64 Gb Free Space | 99.90% Space Free | Partition Type: NTFS Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet001 ========== Win32 Services (SafeList) ========== SRV - [2011/07/30 15:31:53 | 003,542,616 | ---- | M] () [Auto] -- C:/Program Files/Common Files/Akamai/netsession_win_2da1ebd.dll -- (Akamai) SRV - [2011/07/23 08:24:24 | 000,269,480 | ---- | M] (Avira GmbH) [Disabled] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011/04/21 01:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Disabled] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010/06/21 11:47:04 | 000,246,584 | ---- | M] () [Auto] -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service) SRV - [2010/01/15 08:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService) SRV - [2008/08/26 20:52:14 | 000,159,744 | ---- | M] () [Auto] -- C:\Program Files\System Control Manager\MSIService.exe -- (Micro Star SCM) SRV - [2008/03/18 00:27:12 | 000,013,312 | ---- | M] (Agere Systems) [Auto] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio) SRV - [2008/01/20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007/09/28 20:05:16 | 000,128,360 | ---- | M] (TOSHIBA CORPORATION) [Auto] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand] -- -- (SymIMMP) DRV - File not found [Kernel | On_Demand] -- -- (SymIM) DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand] -- -- (IpInIp) DRV - File not found [Kernel | On_Demand] -- -- (EagleNT) DRV - [2011/07/23 08:24:24 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011/07/23 08:24:24 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011/07/21 15:46:11 | 000,233,024 | ---- | M] (DT Soft Ltd) [Kernel | System] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV - [2009/10/08 11:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2008/09/24 00:26:00 | 007,585,920 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2008/06/30 07:56:12 | 000,917,504 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2008/06/09 04:45:08 | 001,748,352 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC) DRV - [2008/05/02 01:59:40 | 000,122,368 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2008/04/28 13:54:58 | 000,054,784 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\enecir.sys -- (enecir) DRV - [2008/04/27 18:29:26 | 003,658,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R) DRV - [2008/03/21 00:13:00 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2008/02/15 19:01:06 | 000,131,712 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfbd.sys -- (tosrfbd) DRV - [2008/01/31 19:55:06 | 000,074,240 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Tosrfhid.sys -- (Tosrfhid) DRV - [2008/01/23 00:57:48 | 000,054,144 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\TosRfSnd.sys -- (TosRfSnd) DRV - [2007/11/29 13:45:44 | 000,036,608 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfbnp.sys -- (tosrfbnp) DRV - [2007/10/18 18:25:00 | 000,041,856 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfusb.sys -- (Tosrfusb) DRV - [2007/10/02 15:43:22 | 000,064,128 | ---- | M] (TOSHIBA Corporation) [Kernel | System] -- C:\Windows\System32\drivers\tosrfcom.sys -- (Tosrfcom) DRV - [2006/10/10 23:33:00 | 000,041,600 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosporte.sys -- (tosporte) DRV - [2005/01/07 09:42:00 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfnds.sys -- (tosrfnds) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.msi.com.tw IE - HKLM\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKLM\..\URLSearchHook: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll (Conduit Ltd.) IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKLM\..\URLSearchHook: {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.) IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Onkel_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.msi.com.tw IE - HKU\Onkel_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1700389 IE - HKU\Onkel_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\Onkel_ON_C\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKU\Onkel_ON_C\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) IE - HKU\Onkel_ON_C\..\URLSearchHook: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll (Conduit Ltd.) IE - HKU\Onkel_ON_C\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKU\Onkel_ON_C\..\URLSearchHook: {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.) IE - HKU\Onkel_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/07/22 15:03:52 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/07/22 19:03:56 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2011/07/22 19:03:56 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011/07/08 03:31:38 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2010/01/01 04:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2010/01/01 04:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011/08/14 07:59:18 | 000,000,143 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\foxsearch.src [2010/01/01 04:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2010/01/01 04:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2010/01/01 04:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (IsoBuster Toolbar) - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll (Conduit Ltd.) O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found. O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (ClipGrab Toolbar) - {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (IsoBuster Toolbar) - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found. O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Onkel\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH) O3 - HKLM\..\Toolbar: (ClipGrab Toolbar) - {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.) O3 - HKU\Onkel_ON_C\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKU\Onkel_ON_C\..\Toolbar\WebBrowser: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Onkel\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH) O3 - HKU\Onkel_ON_C\..\Toolbar\WebBrowser: (ClipGrab Toolbar) - {E36DF325-3F4B-476F-8F89-123BC5D51A30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [ccApp] File not found O4 - HKLM..\Run: [isCfgWiz] File not found O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION) O4 - HKLM..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe (Mirco-Star International CO., LTD.) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [PSQLLauncher] C:\Program Files\Protector Suite QL\launcher.exe (UPEK Inc.) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\Onkel_ON_C..\Run: [avupdate] C:\Users\Onkel\AppData\Roaming\jashla.exe (Legion) O4 - HKU\Onkel_ON_C..\Run: [DAEMON Tools Pro Agent] C:\Program Files\DAEMON Tools Pro\DTAgent.exe (DT Soft Ltd) O4 - HKU\Onkel_ON_C..\Run: [ICQ] C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.) O4 - HKU\Onkel_ON_C..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe () O4 - HKU\Onkel_ON_C..\Run: [winlogon] C:\Users\Onkel\AppData\Roaming\logs\winlogon.exe () O4 - Startup: Error locating startup folders. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1 O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.26.0.cab (SysInfo Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\Windows\System32\vrlogon.dll (UPEK Inc.) O20 - Winlogon\Notify\psfus: DllName - C:\Windows\system32\psqlpwd.dll - C:\Windows\System32\psqlpwd.dll (UPEK Inc.) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011/08/16 15:04:31 | 000,000,000 | ---D | C] -- C:\Diablo IId [2011/08/14 13:23:35 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\Setup1.exe [2011/08/14 13:23:34 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE [2011/08/14 10:47:16 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0 [2011/08/14 08:06:26 | 000,000,000 | ---D | C] -- C:\Program Files\NCH Software [2011/08/14 08:06:15 | 000,000,000 | ---D | C] -- C:\ProgramData\NCH Swift Sound [2011/08/14 08:06:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite [2011/08/14 08:06:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audio Related Programs [2011/08/14 08:06:04 | 000,000,000 | ---D | C] -- C:\Program Files\NCH Swift Sound [2011/08/14 07:59:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IsoBuster [2011/08/14 07:59:26 | 000,000,000 | ---D | C] -- C:\Program Files\IsoBuster [2011/08/14 07:59:25 | 000,000,000 | ---D | C] -- C:\Program Files\Smart Projects [2011/08/14 07:59:14 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Gutscheinmieze [2011/08/14 07:11:31 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Documents\Ulead Burn.Now [2011/08/14 07:11:30 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Ulead Systems [2011/08/13 05:56:53 | 000,000,000 | -HSD | C] -- C:\found.000 [2011/08/07 12:19:03 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Desktop\TXT [2011/08/07 12:19:03 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Desktop\MPG [2011/08/06 16:02:15 | 000,000,000 | ---D | C] -- C:\Awesom-O 5.0b3 [2011/08/03 16:20:42 | 000,000,000 | ---D | C] -- C:\Windows\pss [2011/08/01 21:34:39 | 000,192,000 | ---- | C] (Legion) -- C:\Users\Onkel\AppData\Roaming\jashla.exe [2011/07/30 16:42:03 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\logs [2011/07/30 16:35:39 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP [2011/07/30 16:11:28 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\alaplaya [2011/07/30 16:11:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\alaplaya [2011/07/30 16:11:06 | 000,000,000 | ---D | C] -- C:\Program Files\alaplaya [2011/07/30 15:31:38 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Akamai [2011/07/29 18:12:08 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Desktop\Diablo IId [2011/07/24 18:17:22 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Local\PMB Files [2011/07/24 18:17:21 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files [2011/07/24 18:16:48 | 000,000,000 | ---D | C] -- C:\Program Files\Pando Networks [2011/07/24 12:41:05 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit [2011/07/24 12:41:04 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Local\Conduit [2011/07/24 12:40:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClipGrab [2011/07/24 12:40:47 | 000,000,000 | ---D | C] -- C:\Program Files\ClipGrab [2011/07/23 14:50:28 | 000,000,000 | ---D | C] -- C:\Program Files\SystemRequirementsLab [2011/07/23 14:50:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus [2011/07/22 19:04:05 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Skype [2011/07/22 19:03:52 | 000,000,000 | R--D | C] -- C:\Program Files\Skype [2011/07/22 19:03:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2011/07/22 19:03:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype [2011/07/22 15:04:10 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Local\Mozilla [2011/07/22 15:03:52 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2011/07/22 13:59:19 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Documents\ICQ [2011/07/22 13:38:37 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Avira [2011/07/22 13:37:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2011/07/22 13:37:25 | 000,138,192 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2011/07/22 13:37:25 | 000,066,616 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2011/07/22 13:37:25 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys [2011/07/22 13:37:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2011/07/22 13:37:24 | 000,000,000 | ---D | C] -- C:\Program Files\Avira [2011/07/22 10:10:46 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Diablo II [2011/07/22 10:02:35 | 000,102,400 | ---- | C] (Blizzard Entertainment) -- C:\Windows\DIIUnin.exe [2011/07/21 15:46:11 | 000,233,024 | ---- | C] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys [2011/07/21 15:46:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Pro [2011/07/21 15:46:08 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Pro [2011/07/21 15:46:02 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\DAEMON Tools Pro [2011/07/21 15:46:02 | 000,000,000 | ---D | C] -- C:\ProgramData\DAEMON Tools Pro [2011/07/21 14:19:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo II [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011/08/17 10:51:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011/08/17 10:51:46 | 3220,340,736 | -HS- | M] () -- C:\hiberfil.sys [2011/08/16 15:40:42 | 000,000,680 | ---- | M] () -- C:\Users\Onkel\AppData\Local\d3d9caps.dat [2011/08/16 15:12:25 | 000,000,593 | ---- | M] () -- C:\Users\Onkel\Desktop\Diablo II - Verknüpfung.lnk [2011/08/16 15:05:45 | 000,627,756 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011/08/16 15:05:45 | 000,595,386 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011/08/16 15:05:45 | 000,125,870 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011/08/16 15:05:45 | 000,103,460 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011/08/16 10:50:59 | 000,450,560 | ---- | M] () -- C:\ProgramData\Onkel.jpg [2011/08/16 10:50:03 | 000,042,559 | ---- | M] () -- C:\ProgramData\nvModes.001 [2011/08/16 10:49:52 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011/08/16 10:49:47 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011/08/16 10:49:47 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011/08/14 13:23:35 | 000,249,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\Setup1.exe [2011/08/14 13:23:34 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE [2011/08/14 11:55:37 | 000,001,275 | -H-- | M] () -- C:\Users\Onkel\AppData\Roaming\Inf468 [2011/08/14 11:53:49 | 000,000,618 | -H-- | M] () -- C:\Users\Onkel\AppData\Roaming\Inf002 [2011/08/14 11:53:46 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2011/08/14 11:53:09 | 000,042,559 | ---- | M] () -- C:\ProgramData\nvModes.dat [2011/08/14 08:06:37 | 000,000,976 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Rip.lnk [2011/08/14 08:06:37 | 000,000,964 | ---- | M] () -- C:\Users\Public\Desktop\Express Rip.lnk [2011/08/14 08:06:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite [2011/08/14 08:06:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audio Related Programs [2011/08/14 08:06:26 | 000,000,945 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WavePad Sound Editor.lnk [2011/08/14 08:06:26 | 000,000,933 | ---- | M] () -- C:\Users\Public\Desktop\WavePad Sound Editor.lnk [2011/08/14 08:06:04 | 000,001,032 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Burn Disc Burning Software.lnk [2011/08/14 08:06:04 | 000,001,020 | ---- | M] () -- C:\Users\Public\Desktop\Express Burn Disc Burning Software.lnk [2011/08/14 08:02:09 | 208,970,042 | ---- | M] () -- C:\Users\Onkel\Documents\hgj.ixb [2011/08/14 07:59:27 | 000,000,935 | ---- | M] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\IsoBuster.lnk [2011/08/14 07:59:27 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IsoBuster [2011/08/14 06:49:38 | 000,002,509 | ---- | M] () -- C:\Users\Public\Desktop\MSI BurnRecovery.lnk [2011/08/13 05:53:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011/08/10 16:41:49 | 000,016,384 | ---- | M] () -- C:\ProgramData\key3.db [2011/08/06 16:28:19 | 000,000,057 | -H-- | M] () -- C:\ProgramData\Inf001 [2011/08/04 14:40:33 | 000,000,000 | R--D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup [2011/08/01 21:34:39 | 000,192,000 | ---- | M] (Legion) -- C:\Users\Onkel\AppData\Roaming\jashla.exe [2011/08/01 09:26:37 | 000,387,135 | ---- | M] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe [2011/07/30 21:53:49 | 000,218,631 | ---- | M] () -- C:\Users\Onkel\Documents\DSC01236.JPG [2011/07/30 16:42:11 | 000,333,288 | ---- | M] () -- C:\Windows\System32\sqlite3.dll [2011/07/30 16:11:28 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\alaplaya [2011/07/29 18:22:46 | 000,026,895 | ---- | M] () -- C:\Windows\DIIUnin.dat [2011/07/29 15:34:14 | 000,686,253 | ---- | M] () -- C:\Users\Onkel\Documents\DSC08338.JPG [2011/07/29 14:59:13 | 000,838,465 | ---- | M] () -- C:\Users\Onkel\Documents\DSC08341.JPG [2011/07/29 14:55:25 | 000,157,227 | ---- | M] () -- C:\Users\Onkel\Documents\DSC01247.JPG [2011/07/29 14:55:19 | 000,116,645 | ---- | M] () -- C:\Users\Onkel\Documents\DSC01245.JPG [2011/07/27 09:40:43 | 002,358,894 | ---- | M] () -- C:\Users\Onkel\Documents\09052011129.jpg [2011/07/27 09:40:22 | 001,497,447 | ---- | M] () -- C:\Users\Onkel\Documents\09052011117.jpg [2011/07/24 17:54:43 | 000,000,948 | ---- | M] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk [2011/07/24 17:49:15 | 002,574,324 | ---- | M] () -- C:\Users\Onkel\Documents\bitch.JPG [2011/07/24 17:42:31 | 001,981,420 | ---- | M] () -- C:\Users\Onkel\Documents\P7180756.JPG [2011/07/24 13:09:35 | 001,794,999 | ---- | M] () -- C:\Users\Onkel\Documents\IMG_2551.JPG [2011/07/24 13:07:59 | 000,199,596 | ---- | M] () -- C:\Users\Onkel\Documents\session esther 040.jpg [2011/07/24 12:45:08 | 006,768,008 | ---- | M] () -- C:\Users\Onkel\Documents\DJ Antoine - Broadway 2011 (Radio Edit).mp3 [2011/07/24 12:40:51 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClipGrab [2011/07/23 14:50:16 | 000,001,719 | ---- | M] () -- C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk [2011/07/23 14:50:16 | 000,001,717 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2011/07/23 14:50:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus [2011/07/23 08:24:24 | 000,138,192 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2011/07/23 08:24:24 | 000,066,616 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2011/07/22 19:03:52 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2011/07/22 15:04:16 | 000,294,912 | ---- | M] () -- C:\ProgramData\signons.sqlite [2011/07/22 15:03:53 | 000,000,880 | ---- | M] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk [2011/07/22 15:03:53 | 000,000,868 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2011/07/22 15:03:53 | 000,000,856 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2011/07/22 13:37:29 | 000,001,857 | ---- | M] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk [2011/07/22 13:37:29 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2011/07/22 10:11:40 | 002,108,703 | ---- | M] () -- C:\patch_d2.mpq [2011/07/22 10:10:56 | 000,021,840 | ---- | M] () -- C:\Windows\System32\SIntfNT.dll [2011/07/22 10:10:56 | 000,017,212 | ---- | M] () -- C:\Windows\System32\SIntf32.dll [2011/07/22 10:10:56 | 000,012,067 | ---- | M] () -- C:\Windows\System32\SIntf16.dll [2011/07/22 10:02:35 | 000,102,400 | ---- | M] (Blizzard Entertainment) -- C:\Windows\DIIUnin.exe [2011/07/22 10:02:35 | 000,002,829 | ---- | M] () -- C:\Windows\DIIUnin.pif [2011/07/22 10:02:35 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo II [2011/07/21 17:42:19 | 000,000,226 | ---- | M] () -- C:\Users\Onkel\Documents\Dokument.rtf [2011/07/21 17:09:46 | 000,043,520 | ---- | M] () -- C:\Windows\System32\CmdLineExt03.dll [2011/07/21 15:46:43 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Pro [2011/07/21 15:46:11 | 000,233,024 | ---- | M] (DT Soft Ltd) -- C:\Windows\System32\drivers\dtsoftbus01.sys [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2011/08/17 10:51:46 | 3220,340,736 | -HS- | C] () -- C:\hiberfil.sys [2011/08/16 10:50:21 | 000,450,560 | ---- | C] () -- C:\ProgramData\Onkel.jpg [2011/08/16 10:50:19 | 000,294,912 | ---- | C] () -- C:\ProgramData\signons.sqlite [2011/08/16 10:50:19 | 000,016,384 | ---- | C] () -- C:\ProgramData\key3.db [2011/08/14 08:06:37 | 000,000,976 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Rip.lnk [2011/08/14 08:06:37 | 000,000,964 | ---- | C] () -- C:\Users\Public\Desktop\Express Rip.lnk [2011/08/14 08:06:26 | 000,000,945 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WavePad Sound Editor.lnk [2011/08/14 08:06:26 | 000,000,933 | ---- | C] () -- C:\Users\Public\Desktop\WavePad Sound Editor.lnk [2011/08/14 08:06:04 | 000,001,032 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Burn Disc Burning Software.lnk [2011/08/14 08:06:04 | 000,001,020 | ---- | C] () -- C:\Users\Public\Desktop\Express Burn Disc Burning Software.lnk [2011/08/14 08:02:07 | 208,970,042 | ---- | C] () -- C:\Users\Onkel\Documents\hgj.ixb [2011/08/14 07:59:27 | 000,000,935 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\IsoBuster.lnk [2011/08/08 12:33:50 | 000,001,275 | -H-- | C] () -- C:\Users\Onkel\AppData\Roaming\Inf468 [2011/08/08 12:33:50 | 000,000,618 | -H-- | C] () -- C:\Users\Onkel\AppData\Roaming\Inf002 [2011/08/07 12:21:41 | 002,108,703 | ---- | C] () -- C:\patch_d2.mpq [2011/08/06 16:15:08 | 000,387,135 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe [2011/08/06 16:15:08 | 000,000,057 | -H-- | C] () -- C:\ProgramData\Inf001 [2011/08/04 14:58:43 | 000,000,680 | ---- | C] () -- C:\Users\Onkel\AppData\Local\d3d9caps.dat [2011/08/04 14:40:33 | 000,001,717 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2011/08/04 14:40:33 | 000,001,167 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk [2011/08/04 14:40:33 | 000,000,821 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk [2011/07/30 21:53:36 | 000,218,631 | ---- | C] () -- C:\Users\Onkel\Documents\DSC01236.JPG [2011/07/30 16:42:04 | 000,333,288 | ---- | C] () -- C:\Windows\System32\sqlite3.dll [2011/07/29 19:17:12 | 000,000,593 | ---- | C] () -- C:\Users\Onkel\Desktop\Diablo II - Verknüpfung.lnk [2011/07/29 15:34:08 | 000,686,253 | ---- | C] () -- C:\Users\Onkel\Documents\DSC08338.JPG [2011/07/29 14:59:05 | 000,838,465 | ---- | C] () -- C:\Users\Onkel\Documents\DSC08341.JPG [2011/07/29 14:55:23 | 000,157,227 | ---- | C] () -- C:\Users\Onkel\Documents\DSC01247.JPG [2011/07/29 14:55:18 | 000,116,645 | ---- | C] () -- C:\Users\Onkel\Documents\DSC01245.JPG [2011/07/27 09:40:11 | 002,358,894 | ---- | C] () -- C:\Users\Onkel\Documents\09052011129.jpg [2011/07/27 09:40:08 | 001,497,447 | ---- | C] () -- C:\Users\Onkel\Documents\09052011117.jpg [2011/07/24 17:54:43 | 000,000,948 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk [2011/07/24 17:48:41 | 002,574,324 | ---- | C] () -- C:\Users\Onkel\Documents\bitch.JPG [2011/07/24 17:42:11 | 001,981,420 | ---- | C] () -- C:\Users\Onkel\Documents\P7180756.JPG [2011/07/24 13:09:19 | 001,794,999 | ---- | C] () -- C:\Users\Onkel\Documents\IMG_2551.JPG [2011/07/24 13:07:56 | 000,199,596 | ---- | C] () -- C:\Users\Onkel\Documents\session esther 040.jpg [2011/07/24 12:44:52 | 006,768,008 | ---- | C] () -- C:\Users\Onkel\Documents\DJ Antoine - Broadway 2011 (Radio Edit).mp3 [2011/07/22 15:03:53 | 000,000,880 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk [2011/07/22 15:03:53 | 000,000,868 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2011/07/22 15:03:53 | 000,000,856 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2011/07/22 13:37:29 | 000,001,857 | ---- | C] () -- C:\Users\Public\Desktop\Avira AntiVir Control Center.lnk [2011/07/22 10:02:38 | 000,026,895 | ---- | C] () -- C:\Windows\DIIUnin.dat [2011/07/22 10:02:35 | 000,002,829 | ---- | C] () -- C:\Windows\DIIUnin.pif [2011/07/21 17:42:19 | 000,000,226 | ---- | C] () -- C:\Users\Onkel\Documents\Dokument.rtf [2011/07/21 15:56:32 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll [2011/07/21 14:33:02 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll [2011/07/21 14:33:02 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll [2011/07/21 14:33:02 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll [2011/06/02 08:59:31 | 000,003,584 | ---- | C] () -- C:\Users\Onkel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010/06/19 11:44:26 | 000,840,580 | ---- | C] () -- C:\ProgramData\LuUninstall.LiveUpdate [2008/12/23 09:45:59 | 000,000,000 | ---- | C] () -- C:\Windows\tosOBEX.INI [2008/12/22 17:27:19 | 001,748,352 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys [2008/12/22 17:27:19 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys [2008/12/22 17:16:37 | 000,042,559 | ---- | C] () -- C:\ProgramData\nvModes.001 [2008/12/22 17:10:52 | 000,042,559 | ---- | C] () -- C:\ProgramData\nvModes.dat [2008/12/22 16:21:02 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2008/12/22 16:21:02 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2008/12/22 15:29:15 | 000,627,756 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2008/12/22 15:29:15 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2008/12/22 15:29:15 | 000,125,870 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2008/12/22 15:29:15 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2007/12/21 20:46:32 | 000,118,784 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll [2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006/11/02 08:47:37 | 000,265,896 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006/11/02 06:33:01 | 000,595,386 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006/11/02 06:33:01 | 000,103,460 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2005/07/23 01:30:18 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll ========== LOP Check ========== [2011/07/21 15:47:14 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\DAEMON Tools Pro [2011/08/14 07:59:18 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\Gutscheinmieze [2011/08/17 00:12:04 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\ICQ [2011/07/30 16:57:00 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\logs [2010/06/19 11:36:54 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\Protector Suite [2011/08/14 07:11:30 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\Ulead Systems [2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data [2011/07/20 14:26:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Ask [2011/07/21 15:46:06 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Pro [2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop [2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents [2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites [2011/05/02 11:02:49 | 000,000,000 | ---D | M] -- C:\ProgramData\ICQ [2011/08/14 08:06:15 | 000,000,000 | ---D | M] -- C:\ProgramData\NCH Swift Sound [2011/07/24 18:18:10 | 000,000,000 | ---D | M] -- C:\ProgramData\PMB Files [2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu [2011/07/31 15:33:58 | 000,000,000 | ---D | M] -- C:\ProgramData\TEMP [2006/11/02 09:02:04 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates [2008/12/22 17:20:22 | 000,000,000 | ---D | M] -- C:\ProgramData\UIB [2011/08/14 07:11:29 | 000,000,000 | ---D | M] -- C:\ProgramData\Ulead Systems [2011/08/04 14:43:50 | 000,032,636 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:F63A059B < End of report > |
20.08.2011, 05:38 | #4 |
/// Helfer-Team | Hilfe bundespolizei trojaner !!! 1. Fixen mit OTL
Code:
ATTFilter :OTL SRV - [2010/01/15 08:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand] -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService) IE - HKLM\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKLM\..\URLSearchHook: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll (Conduit Ltd.) IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKLM\..\URLSearchHook: {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.) IE - HKU\Onkel_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1700389 IE - HKU\Onkel_ON_C\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKU\Onkel_ON_C\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) IE - HKU\Onkel_ON_C\..\URLSearchHook: {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll (Conduit Ltd.) IE - HKU\Onkel_ON_C\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) [2010/01/01 04:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml [2010/01/01 04:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O2 - BHO: (IsoBuster Toolbar) - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll (Conduit Ltd.) O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found. O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.) O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (ClipGrab Toolbar) - {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (IsoBuster Toolbar) - {266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} - C:\Program Files\IsoBuster\tbIsoB.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found. O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Onkel\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH) O3 - HKLM\..\Toolbar: (ClipGrab Toolbar) - {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.) O3 - HKU\Onkel_ON_C\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKU\Onkel_ON_C\..\Toolbar\WebBrowser: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Users\Onkel\AppData\Roaming\Gutscheinmieze\toolbar.dll (Synatix GmbH) O3 - HKU\Onkel_ON_C\..\Toolbar\WebBrowser: (ClipGrab Toolbar) - {E36DF325-3F4B-476F-8F89-123BC5D51A30} - C:\Program Files\ClipGrab\prxtbClip.dll (Conduit Ltd.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM..\Run: [ccApp] File not found O4 - HKLM..\Run: [isCfgWiz] File not found O4 - HKU\Onkel_ON_C..\Run: [avupdate] C:\Users\Onkel\AppData\Roaming\jashla.exe (Legion) O4 - HKU\Onkel_ON_C..\Run: [winlogon] C:\Users\Onkel\AppData\Roaming\logs\winlogon.exe () [2011/08/01 21:34:39 | 000,192,000 | ---- | C] (Legion) -- C:\Users\Onkel\AppData\Roaming\jashla.exe [2011/07/24 12:41:04 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Local\Conduit [2011/07/20 14:26:20 | 000,000,000 | ---D | M] -- C:\ProgramData\Ask @Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:F63A059B :Commands [purity] [emptytemp]
** kannst Du wieder normal starten? 2. erneut einen Scan mit OTL:
__________________ Warnung!: Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein! Anhang nicht öffnen, in unserem Forum erst nachfragen! Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten! Bitte diese Warnung weitergeben, wo Du nur kannst! |
20.08.2011, 10:38 | #5 |
| Hilfe bundespolizei trojaner !!! Da gibt es ein problem, ich hab die OTL.exe auf mein Desktop gezogen und Doppelklick drauf aber da passiert nichts. und wenn ich als Adminstrator Starten will steht da nur: B:\Documents and Settings\Default User\Desktop\OTL.exe The specified service does not exist as an installed service. |
21.08.2011, 05:46 | #6 | |
/// Helfer-Team | Hilfe bundespolizei trojaner !!!Zitat:
Anleitung nochmal lesen:-> http://www.trojaner-board.de/102696-...tml#post694737
__________________ --> Hilfe bundespolizei trojaner !!! |
21.08.2011, 10:17 | #7 |
| Hilfe bundespolizei trojaner !!! verzeihung habe da was falsch gemacht aber jetzt hat alles geklappt. ich stell mal die ganzen logs hier rein Das ist vom Fix scan Code:
ATTFilter ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\McComponentHostService deleted successfully. C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}\ deleted successfully. C:\Program Files\IsoBuster\tbIsoB.dll moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully. C:\Program Files\ICQ6Toolbar\ICQToolBar.dll moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{e36df325-3f4b-476f-8f89-123bc5d51a30} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e36df325-3f4b-476f-8f89-123bc5d51a30}\ deleted successfully. C:\Program Files\ClipGrab\prxtbClip.dll moved successfully. HKU\Onkel_ON_C\Software\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully! Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully. Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ deleted successfully. C:\Program Files\Ask.com\GenericAskToolbar.dll moved successfully. Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks\\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}\ not found. File C:\Program Files\IsoBuster\tbIsoB.dll not found. Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found. File C:\Program Files\ICQ6Toolbar\ICQToolBar.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully. File C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) not found. Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully. File C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) not found. C:\Program Files\Mozilla Firefox\searchplugins\bing.xml moved successfully. C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}\ not found. File C:\Program Files\IsoBuster\tbIsoB.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}\ not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}\ deleted successfully. C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll moved successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully. File C:\Program Files\Ask.com\GenericAskToolbar.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e36df325-3f4b-476f-8f89-123bc5d51a30}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e36df325-3f4b-476f-8f89-123bc5d51a30}\ not found. File C:\Program Files\ClipGrab\prxtbClip.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{266fcdca-7bb3-4da7-b3bf-f845dea2ebd6}\ not found. File C:\Program Files\IsoBuster\tbIsoB.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{855F3B16-6D32-4FE6-8A56-BBB695989046} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}\ not found. File C:\Program Files\ICQ6Toolbar\ICQToolBar.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found. File C:\Program Files\Ask.com\GenericAskToolbar.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27}\ deleted successfully. C:\Users\Onkel\AppData\Roaming\Gutscheinmieze\toolbar.dll moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{e36df325-3f4b-476f-8f89-123bc5d51a30} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e36df325-3f4b-476f-8f89-123bc5d51a30}\ not found. File C:\Program Files\ClipGrab\prxtbClip.dll not found. Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found. File C:\Program Files\Ask.com\GenericAskToolbar.dll not found. Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DFEFCDEE-CF1A-4FC8-88AD-48514E463B27}\ not found. File C:\Users\Onkel\AppData\Roaming\Gutscheinmieze\toolbar.dll not found. Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E36DF325-3F4B-476F-8F89-123BC5D51A30} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E36DF325-3F4B-476F-8F89-123BC5D51A30}\ not found. File C:\Program Files\ClipGrab\prxtbClip.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater deleted successfully. C:\Program Files\Ask.com\Updater\Updater.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ccApp deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\isCfgWiz deleted successfully. Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\avupdate deleted successfully. C:\Users\Onkel\AppData\Roaming\jashla.exe moved successfully. Registry value HKEY_USERS\Onkel_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\winlogon deleted successfully. C:\Users\Onkel\AppData\Roaming\logs\winlogon.exe moved successfully. File C:\Users\Onkel\AppData\Roaming\jashla.exe not found. C:\Users\Onkel\AppData\Local\Conduit\CT2536373 folder moved successfully. C:\Users\Onkel\AppData\Local\Conduit folder moved successfully. C:\ProgramData\Ask\APN-Stub folder moved successfully. C:\ProgramData\Ask folder moved successfully. ADS C:\ProgramData\TEMP:F63A059B deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] Empty user temp failed. Cannot find local settings folders. Empty user temp failed. Cannot find local settings folders. Empty user temp failed. Cannot find local settings folders. Empty user temp failed. Cannot find local settings folders. Empty user temp failed. Cannot find local settings folders. Empty user temp failed. Cannot find local settings folders. %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 6 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 49562878 bytes Total Files Cleaned = 47.00 mb OTLPE by OldTimer - Version 3.1.48.0 log created on 08212011_135315 jetzt die Extras.txt Code:
ATTFilter OTL Extras logfile created on: 8/21/2011 3:05:41 PM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE Windows Vista (TM) Home Premium Service Pack 1 (Version = 6.0.6001) - Type = System Internet Explorer (Version = 8.0.6001.19088) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free 3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 34.18 Gb Total Space | 0.57 Gb Free Space | 1.66% Space Free | Partition Type: NTFS Drive E: | 263.91 Gb Total Space | 263.64 Gb Free Space | 99.90% Space Free | Partition Type: NTFS Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet001 ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 "UacDisableNotify" = 0 "InternetSettingsDisableNotify" = 0 "AutoUpdateDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] "DisableMonitoring" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 ========== Authorized Applications List ========== ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu "{07690F1C-04B1-4060-9691-6748ED1826B9}" = MSI Software Install "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{1F77C418-2C90-459C-BD33-B56A4182B9FA}" = System Requirements Lab CYRI "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer "{23B14BE4-5277-40B2-B602-3FCD456C27BC}" = Protector Suite QL 5.8 "{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 26 "{2892E1B7-E24D-4CCB-B8A7-B63D4B66F89F}" = BurnRecovery "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5 "{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar "{87725CEF-1BC6-47C5-B2CD-96DD6D392EE3}" = Dolby Control Center "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 8168 8101E 8102E Ethernet Driver "{8A1033B0-EF33-4FB5-97A1-C47A7DCDD7E6}_is1" = ClipGrab 3.1.0.1 "{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007 "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007 "{90120000-0016-040C-0000-0000000FF1CE}" = Microsoft Office Excel MUI (French) 2007 "{90120000-0016-0410-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Italian) 2007 "{90120000-0016-0C0A-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Spanish) 2007 "{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007 "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007 "{90120000-0018-040C-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (French) 2007 "{90120000-0018-0410-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Italian) 2007 "{90120000-0018-0C0A-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Spanish) 2007 "{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007 "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007 "{90120000-001B-040C-0000-0000000FF1CE}" = Microsoft Office Word MUI (French) 2007 "{90120000-001B-0410-0000-0000000FF1CE}" = Microsoft Office Word MUI (Italian) 2007 "{90120000-001B-0C0A-0000-0000000FF1CE}" = Microsoft Office Word MUI (Spanish) 2007 "{90120000-001F-0401-0000-0000000FF1CE}" = Microsoft Office Proof (Arabic) 2007 "{90120000-001F-0403-0000-0000000FF1CE}" = Microsoft Office Proof (Catalan) 2007 "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007 "{90120000-001F-0413-0000-0000000FF1CE}" = Microsoft Office Proof (Dutch) 2007 "{90120000-001F-0416-0000-0000000FF1CE}" = Microsoft Office Proof (Portuguese (Brazil)) 2007 "{90120000-001F-042D-0000-0000000FF1CE}" = Microsoft Office Proof (Basque) 2007 "{90120000-001F-0456-0000-0000000FF1CE}" = Microsoft Office Proof (Galician) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007 "{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007 "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007 "{90120000-002C-040C-0000-0000000FF1CE}" = Microsoft Office Proofing (French) 2007 "{90120000-002C-0410-0000-0000000FF1CE}" = Microsoft Office Proofing (Italian) 2007 "{90120000-002C-0C0A-0000-0000000FF1CE}" = Microsoft Office Proofing (Spanish) 2007 "{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007 "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007 "{90120000-006E-040C-0000-0000000FF1CE}" = Microsoft Office Shared MUI (French) 2007 "{90120000-006E-0410-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Italian) 2007 "{90120000-006E-0C0A-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Spanish) 2007 "{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007 "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007 "{90120000-00A1-040C-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (French) 2007 "{90120000-00A1-0410-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Italian) 2007 "{90120000-00A1-0C0A-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Spanish) 2007 "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007 "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007 "{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster "{A3BE3F1E-2472-4211-8735-E8239BE49D9F}" = Ulead Burn.Now 4.5 "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2 "{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Toolbars "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba "{D6F879CC-59D6-4D4B-AE9B-D761E48D25ED}" = Skype™ 5.3 "{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader "{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant "{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}" = System Control Manager "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "5D38134BF8A10D640B30E6B014EECDBC5F881E3D" = Windows Driver Package - ENE (enecir) HIDClass (04/29/2008 2.5.0.0) "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Agere Systems Soft Modem" = Agere Systems HDA Modem "Akamai" = Akamai NetSession Interface "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "ClipGrab Toolbar" = ClipGrab Toolbar "DAEMON Tools Pro" = DAEMON Tools Pro "Diablo II" = Diablo II "ExpressBurn" = Express Burn Disc Burning Software "ExpressRip" = Express Rip "FantasyTennis" = FantasyTennis "Gutscheinmieze - Toolbar" = Gutscheinmieze - Toolbar "HOMESTUDENTR" = Microsoft Office Home and Student 2007 "ICQToolbar" = ICQ Toolbar "InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}" = Ulead Burn.Now 4.5 SE "IsoBuster Toolbar" = IsoBuster Toolbar "IsoBuster_is1" = IsoBuster 2.8 "McAfee Security Scan" = McAfee Security Scan Plus "Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Mozilla Firefox 5.0.1 (x86 de)" = Mozilla Firefox 5.0.1 (x86 de) "NVIDIA Drivers" = NVIDIA Drivers "WavePad" = WavePad Sound Editor "WinRAR archiver" = WinRAR archiver < End of report > Und jetzt OTL.Txt Code:
ATTFilter OTL logfile created on: 8/21/2011 3:05:41 PM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE Windows Vista (TM) Home Premium Service Pack 1 (Version = 6.0.6001) - Type = System Internet Explorer (Version = 8.0.6001.19088) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 91.00% Memory free 3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 34.18 Gb Total Space | 0.57 Gb Free Space | 1.66% Space Free | Partition Type: NTFS Drive E: | 263.91 Gb Total Space | 263.64 Gb Free Space | 99.90% Space Free | Partition Type: NTFS Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet001 ========== Win32 Services (SafeList) ========== SRV - [2011/07/30 15:31:53 | 003,542,616 | ---- | M] () [Auto] -- C:/Program Files/Common Files/Akamai/netsession_win_2da1ebd.dll -- (Akamai) SRV - [2011/07/23 08:24:24 | 000,269,480 | ---- | M] (Avira GmbH) [Disabled] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011/04/21 01:52:51 | 000,136,360 | ---- | M] (Avira GmbH) [Disabled] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010/06/21 11:47:04 | 000,246,584 | ---- | M] () [Auto] -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service) SRV - [2008/08/26 20:52:14 | 000,159,744 | ---- | M] () [Auto] -- C:\Program Files\System Control Manager\MSIService.exe -- (Micro Star SCM) SRV - [2008/03/18 00:27:12 | 000,013,312 | ---- | M] (Agere Systems) [Auto] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio) SRV - [2008/01/20 22:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2007/09/28 20:05:16 | 000,128,360 | ---- | M] (TOSHIBA CORPORATION) [Auto] -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand] -- -- (SymIMMP) DRV - File not found [Kernel | On_Demand] -- -- (SymIM) DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand] -- -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand] -- -- (IpInIp) DRV - File not found [Kernel | On_Demand] -- -- (EagleNT) DRV - [2011/07/23 08:24:24 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011/07/23 08:24:24 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011/07/21 15:46:11 | 000,233,024 | ---- | M] (DT Soft Ltd) [Kernel | System] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV - [2009/10/08 11:55:33 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2008/09/24 00:26:00 | 007,585,920 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2008/06/30 07:56:12 | 000,917,504 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2008/06/09 04:45:08 | 001,748,352 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC) DRV - [2008/05/02 01:59:40 | 000,122,368 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2008/04/28 13:54:58 | 000,054,784 | ---- | M] (ENE TECHNOLOGY INC.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\enecir.sys -- (enecir) DRV - [2008/04/27 18:29:26 | 003,658,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R) DRV - [2008/03/21 00:13:00 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2008/02/15 19:01:06 | 000,131,712 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfbd.sys -- (tosrfbd) DRV - [2008/01/31 19:55:06 | 000,074,240 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Tosrfhid.sys -- (Tosrfhid) DRV - [2008/01/23 00:57:48 | 000,054,144 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\TosRfSnd.sys -- (TosRfSnd) DRV - [2007/11/29 13:45:44 | 000,036,608 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfbnp.sys -- (tosrfbnp) DRV - [2007/10/18 18:25:00 | 000,041,856 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfusb.sys -- (Tosrfusb) DRV - [2007/10/02 15:43:22 | 000,064,128 | ---- | M] (TOSHIBA Corporation) [Kernel | System] -- C:\Windows\System32\drivers\tosrfcom.sys -- (Tosrfcom) DRV - [2006/10/10 23:33:00 | 000,041,600 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosporte.sys -- (tosporte) DRV - [2005/01/07 09:42:00 | 000,018,612 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\tosrfnds.sys -- (tosrfnds) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.msi.com.tw IE - HKLM\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Onkel_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.msi.com.tw IE - HKU\Onkel_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = IE - HKU\Onkel_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\Onkel_ON_C\..\URLSearchHook: {e36df325-3f4b-476f-8f89-123bc5d51a30} - Reg Error: Key error. File not found IE - HKU\Onkel_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/07/22 15:03:52 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/07/22 19:03:56 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2011/07/22 19:03:56 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011/07/08 03:31:38 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2010/01/01 04:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2010/01/01 04:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011/08/14 07:59:18 | 000,000,143 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\foxsearch.src [2010/01/01 04:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2010/01/01 04:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe ( TOSHIBA CORPORATION) O4 - HKLM..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe (Mirco-Star International CO., LTD.) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [PSQLLauncher] C:\Program Files\Protector Suite QL\launcher.exe (UPEK Inc.) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\Onkel_ON_C..\Run: [DAEMON Tools Pro Agent] C:\Program Files\DAEMON Tools Pro\DTAgent.exe (DT Soft Ltd) O4 - HKU\Onkel_ON_C..\Run: [ICQ] C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.) O4 - HKU\Onkel_ON_C..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe () O4 - Startup: Error locating startup folders. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1 O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E6F480FC-BD44-4CBA-B74A-89AF7842937D} hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.26.0.cab (SysInfo Class) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\Windows\System32\vrlogon.dll (UPEK Inc.) O20 - Winlogon\Notify\psfus: DllName - C:\Windows\system32\psqlpwd.dll - C:\Windows\System32\psqlpwd.dll (UPEK Inc.) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/09/18 17:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011/08/21 13:49:47 | 000,000,000 | ---D | C] -- C:\_OTL [2011/08/20 19:36:41 | 000,174,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\framedyn.dll [2011/08/20 19:36:10 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Windows\OTL.exe [2011/08/20 18:12:02 | 000,174,592 | ---- | C] (Microsoft Corporation) -- C:\framedyn.dll [2011/08/20 18:11:44 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\OTL.exe [2011/08/16 15:04:31 | 000,000,000 | ---D | C] -- C:\Diablo IId [2011/08/14 13:23:35 | 000,249,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\Setup1.exe [2011/08/14 13:23:34 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE [2011/08/14 10:47:16 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0 [2011/08/14 08:06:26 | 000,000,000 | ---D | C] -- C:\Program Files\NCH Software [2011/08/14 08:06:15 | 000,000,000 | ---D | C] -- C:\ProgramData\NCH Swift Sound [2011/08/14 08:06:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite [2011/08/14 08:06:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audio Related Programs [2011/08/14 08:06:04 | 000,000,000 | ---D | C] -- C:\Program Files\NCH Swift Sound [2011/08/14 07:59:26 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IsoBuster [2011/08/14 07:59:26 | 000,000,000 | ---D | C] -- C:\Program Files\IsoBuster [2011/08/14 07:59:25 | 000,000,000 | ---D | C] -- C:\Program Files\Smart Projects [2011/08/14 07:59:14 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Gutscheinmieze [2011/08/14 07:11:31 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Documents\Ulead Burn.Now [2011/08/14 07:11:30 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Ulead Systems [2011/08/13 05:56:53 | 000,000,000 | -HSD | C] -- C:\found.000 [2011/08/07 12:19:03 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Desktop\TXT [2011/08/07 12:19:03 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Desktop\MPG [2011/08/06 16:02:15 | 000,000,000 | ---D | C] -- C:\Awesom-O 5.0b3 [2011/08/03 16:20:42 | 000,000,000 | ---D | C] -- C:\Windows\pss [2011/07/30 16:42:03 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\logs [2011/07/30 16:35:39 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP [2011/07/30 16:11:28 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\alaplaya [2011/07/30 16:11:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\alaplaya [2011/07/30 16:11:06 | 000,000,000 | ---D | C] -- C:\Program Files\alaplaya [2011/07/30 15:31:38 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Akamai [2011/07/29 18:12:08 | 000,000,000 | ---D | C] -- C:\Users\Onkel\Desktop\Diablo IId [2011/07/24 18:17:22 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Local\PMB Files [2011/07/24 18:17:21 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files [2011/07/24 18:16:48 | 000,000,000 | ---D | C] -- C:\Program Files\Pando Networks [2011/07/24 12:41:05 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit [2011/07/24 12:40:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClipGrab [2011/07/24 12:40:47 | 000,000,000 | ---D | C] -- C:\Program Files\ClipGrab [2011/07/23 14:50:28 | 000,000,000 | ---D | C] -- C:\Program Files\SystemRequirementsLab [2011/07/23 14:50:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus [2011/07/22 19:04:05 | 000,000,000 | ---D | C] -- C:\Users\Onkel\AppData\Roaming\Skype [2011/07/22 19:03:52 | 000,000,000 | R--D | C] -- C:\Program Files\Skype [2011/07/22 19:03:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2011/07/22 19:03:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype ========== Files - Modified Within 30 Days ========== [2011/08/21 07:57:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011/08/21 07:57:14 | 000,122,880 | ---- | M] () -- C:\ProgramData\Onkel.jpg [2011/08/21 07:57:07 | 000,042,559 | ---- | M] () -- C:\ProgramData\nvModes.001 [2011/08/21 07:57:03 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011/08/21 07:57:03 | 000,003,216 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011/08/21 07:56:58 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011/08/21 07:56:49 | 3220,340,736 | -HS- | M] () -- C:\hiberfil.sys [2011/08/20 19:36:15 | 000,000,462 | ---- | M] () -- C:\Windows\OTL.exe.lnk [2011/08/20 18:12:25 | 000,000,380 | ---- | M] () -- C:\OTL.exe.lnk [2011/08/16 15:40:42 | 000,000,680 | ---- | M] () -- C:\Users\Onkel\AppData\Local\d3d9caps.dat [2011/08/16 15:12:25 | 000,000,593 | ---- | M] () -- C:\Users\Onkel\Desktop\Diablo II - Verknüpfung.lnk [2011/08/16 15:05:45 | 000,627,756 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011/08/16 15:05:45 | 000,595,386 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011/08/16 15:05:45 | 000,125,870 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011/08/16 15:05:45 | 000,103,460 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011/08/14 13:23:35 | 000,249,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\Setup1.exe [2011/08/14 13:23:34 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\ST6UNST.EXE [2011/08/14 11:55:37 | 000,001,275 | -H-- | M] () -- C:\Users\Onkel\AppData\Roaming\Inf468 [2011/08/14 11:53:49 | 000,000,618 | -H-- | M] () -- C:\Users\Onkel\AppData\Roaming\Inf002 [2011/08/14 11:53:46 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2011/08/14 11:53:09 | 000,042,559 | ---- | M] () -- C:\ProgramData\nvModes.dat [2011/08/14 08:06:37 | 000,000,976 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Rip.lnk [2011/08/14 08:06:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite [2011/08/14 08:06:37 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audio Related Programs [2011/08/14 08:06:26 | 000,000,945 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WavePad Sound Editor.lnk [2011/08/14 08:06:04 | 000,001,032 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Burn Disc Burning Software.lnk [2011/08/14 08:02:09 | 208,970,042 | ---- | M] () -- C:\Users\Onkel\Documents\hgj.ixb [2011/08/14 07:59:27 | 000,000,935 | ---- | M] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\IsoBuster.lnk [2011/08/14 07:59:27 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IsoBuster [2011/08/13 05:53:00 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011/08/10 16:41:49 | 000,016,384 | ---- | M] () -- C:\ProgramData\key3.db [2011/08/06 16:28:19 | 000,000,057 | -H-- | M] () -- C:\ProgramData\Inf001 [2011/08/04 14:40:33 | 000,000,000 | R--D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup [2011/08/01 09:26:37 | 000,387,135 | ---- | M] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe [2011/07/30 21:53:49 | 000,218,631 | ---- | M] () -- C:\Users\Onkel\Documents\DSC01236.JPG [2011/07/30 16:42:11 | 000,333,288 | ---- | M] () -- C:\Windows\System32\sqlite3.dll [2011/07/30 16:11:28 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\alaplaya [2011/07/29 18:22:46 | 000,026,895 | ---- | M] () -- C:\Windows\DIIUnin.dat [2011/07/29 15:34:14 | 000,686,253 | ---- | M] () -- C:\Users\Onkel\Documents\DSC08338.JPG [2011/07/29 14:59:13 | 000,838,465 | ---- | M] () -- C:\Users\Onkel\Documents\DSC08341.JPG [2011/07/29 14:55:25 | 000,157,227 | ---- | M] () -- C:\Users\Onkel\Documents\DSC01247.JPG [2011/07/29 14:55:19 | 000,116,645 | ---- | M] () -- C:\Users\Onkel\Documents\DSC01245.JPG [2011/07/27 09:40:43 | 002,358,894 | ---- | M] () -- C:\Users\Onkel\Documents\09052011129.jpg [2011/07/27 09:40:22 | 001,497,447 | ---- | M] () -- C:\Users\Onkel\Documents\09052011117.jpg [2011/07/24 17:54:43 | 000,000,948 | ---- | M] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk [2011/07/24 17:49:15 | 002,574,324 | ---- | M] () -- C:\Users\Onkel\Documents\bitch.JPG [2011/07/24 17:42:31 | 001,981,420 | ---- | M] () -- C:\Users\Onkel\Documents\P7180756.JPG [2011/07/24 13:09:35 | 001,794,999 | ---- | M] () -- C:\Users\Onkel\Documents\IMG_2551.JPG [2011/07/24 13:07:59 | 000,199,596 | ---- | M] () -- C:\Users\Onkel\Documents\session esther 040.jpg [2011/07/24 12:45:08 | 006,768,008 | ---- | M] () -- C:\Users\Onkel\Documents\DJ Antoine - Broadway 2011 (Radio Edit).mp3 [2011/07/24 12:40:51 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClipGrab [2011/07/23 14:50:16 | 000,001,717 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2011/07/23 14:50:16 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus [2011/07/23 08:24:24 | 000,138,192 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2011/07/23 08:24:24 | 000,066,616 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2011/07/22 19:03:52 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype ========== Files Created - No Company Name ========== [2011/08/20 19:36:15 | 000,000,462 | ---- | C] () -- C:\Windows\OTL.exe.lnk [2011/08/20 18:12:25 | 000,000,380 | ---- | C] () -- C:\OTL.exe.lnk [2011/08/17 10:51:46 | 3220,340,736 | -HS- | C] () -- C:\hiberfil.sys [2011/08/16 10:50:21 | 000,122,880 | ---- | C] () -- C:\ProgramData\Onkel.jpg [2011/08/16 10:50:19 | 000,294,912 | ---- | C] () -- C:\ProgramData\signons.sqlite [2011/08/16 10:50:19 | 000,016,384 | ---- | C] () -- C:\ProgramData\key3.db [2011/08/14 08:06:37 | 000,000,976 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Rip.lnk [2011/08/14 08:06:26 | 000,000,945 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WavePad Sound Editor.lnk [2011/08/14 08:06:04 | 000,001,032 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Burn Disc Burning Software.lnk [2011/08/14 08:02:07 | 208,970,042 | ---- | C] () -- C:\Users\Onkel\Documents\hgj.ixb [2011/08/14 07:59:27 | 000,000,935 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\IsoBuster.lnk [2011/08/08 12:33:50 | 000,001,275 | -H-- | C] () -- C:\Users\Onkel\AppData\Roaming\Inf468 [2011/08/08 12:33:50 | 000,000,618 | -H-- | C] () -- C:\Users\Onkel\AppData\Roaming\Inf002 [2011/08/07 12:21:41 | 002,108,703 | ---- | C] () -- C:\patch_d2.mpq [2011/08/06 16:15:08 | 000,387,135 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explorer.exe [2011/08/06 16:15:08 | 000,000,057 | -H-- | C] () -- C:\ProgramData\Inf001 [2011/08/04 14:58:43 | 000,000,680 | ---- | C] () -- C:\Users\Onkel\AppData\Local\d3d9caps.dat [2011/08/04 14:40:33 | 000,001,717 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2011/08/04 14:40:33 | 000,001,167 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk [2011/08/04 14:40:33 | 000,000,821 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk [2011/07/30 21:53:36 | 000,218,631 | ---- | C] () -- C:\Users\Onkel\Documents\DSC01236.JPG [2011/07/30 16:42:04 | 000,333,288 | ---- | C] () -- C:\Windows\System32\sqlite3.dll [2011/07/29 19:17:12 | 000,000,593 | ---- | C] () -- C:\Users\Onkel\Desktop\Diablo II - Verknüpfung.lnk [2011/07/29 15:34:08 | 000,686,253 | ---- | C] () -- C:\Users\Onkel\Documents\DSC08338.JPG [2011/07/29 14:59:05 | 000,838,465 | ---- | C] () -- C:\Users\Onkel\Documents\DSC08341.JPG [2011/07/29 14:55:23 | 000,157,227 | ---- | C] () -- C:\Users\Onkel\Documents\DSC01247.JPG [2011/07/29 14:55:18 | 000,116,645 | ---- | C] () -- C:\Users\Onkel\Documents\DSC01245.JPG [2011/07/27 09:40:11 | 002,358,894 | ---- | C] () -- C:\Users\Onkel\Documents\09052011129.jpg [2011/07/27 09:40:08 | 001,497,447 | ---- | C] () -- C:\Users\Onkel\Documents\09052011117.jpg [2011/07/24 17:54:43 | 000,000,948 | ---- | C] () -- C:\Users\Onkel\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk [2011/07/24 17:48:41 | 002,574,324 | ---- | C] () -- C:\Users\Onkel\Documents\bitch.JPG [2011/07/24 17:42:11 | 001,981,420 | ---- | C] () -- C:\Users\Onkel\Documents\P7180756.JPG [2011/07/24 13:09:19 | 001,794,999 | ---- | C] () -- C:\Users\Onkel\Documents\IMG_2551.JPG [2011/07/24 13:07:56 | 000,199,596 | ---- | C] () -- C:\Users\Onkel\Documents\session esther 040.jpg [2011/07/24 12:44:52 | 006,768,008 | ---- | C] () -- C:\Users\Onkel\Documents\DJ Antoine - Broadway 2011 (Radio Edit).mp3 [2011/07/22 10:02:38 | 000,026,895 | ---- | C] () -- C:\Windows\DIIUnin.dat [2011/07/21 15:56:32 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll [2011/07/21 14:33:02 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll [2011/07/21 14:33:02 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll [2011/07/21 14:33:02 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll [2011/06/02 08:59:31 | 000,003,584 | ---- | C] () -- C:\Users\Onkel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010/06/19 11:44:26 | 000,840,580 | ---- | C] () -- C:\ProgramData\LuUninstall.LiveUpdate [2008/12/23 09:45:59 | 000,000,000 | ---- | C] () -- C:\Windows\tosOBEX.INI [2008/12/22 17:27:19 | 001,748,352 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys [2008/12/22 17:27:19 | 000,028,672 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys [2008/12/22 17:16:37 | 000,042,559 | ---- | C] () -- C:\ProgramData\nvModes.001 [2008/12/22 17:10:52 | 000,042,559 | ---- | C] () -- C:\ProgramData\nvModes.dat [2008/12/22 16:21:02 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2008/12/22 16:21:02 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2008/12/22 15:29:15 | 000,627,756 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2008/12/22 15:29:15 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2008/12/22 15:29:15 | 000,125,870 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2008/12/22 15:29:15 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2007/12/21 20:46:32 | 000,118,784 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll [2006/11/02 08:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006/11/02 08:47:37 | 000,265,896 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006/11/02 08:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006/11/02 06:33:01 | 000,595,386 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006/11/02 06:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006/11/02 06:33:01 | 000,103,460 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006/11/02 06:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006/11/02 06:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006/11/02 04:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006/11/02 04:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006/11/02 03:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006/11/02 03:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2005/07/23 01:30:18 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll ========== LOP Check ========== [2011/07/21 15:47:14 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\DAEMON Tools Pro [2011/08/21 13:53:27 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\Gutscheinmieze [2011/08/17 00:12:04 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\ICQ [2011/08/21 13:53:28 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\logs [2010/06/19 11:36:54 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\Protector Suite [2011/08/14 07:11:30 | 000,000,000 | ---D | M] -- C:\Users\Onkel\AppData\Roaming\Ulead Systems [2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data [2011/07/21 15:46:06 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Pro [2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop [2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents [2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites [2011/05/02 11:02:49 | 000,000,000 | ---D | M] -- C:\ProgramData\ICQ [2011/08/14 08:06:15 | 000,000,000 | ---D | M] -- C:\ProgramData\NCH Swift Sound [2011/07/24 18:18:10 | 000,000,000 | ---D | M] -- C:\ProgramData\PMB Files [2006/11/02 09:02:03 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu [2011/07/31 15:33:58 | 000,000,000 | ---D | M] -- C:\ProgramData\TEMP [2006/11/02 09:02:04 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates [2008/12/22 17:20:22 | 000,000,000 | ---D | M] -- C:\ProgramData\UIB [2011/08/14 07:11:29 | 000,000,000 | ---D | M] -- C:\ProgramData\Ulead Systems [2011/08/21 07:57:22 | 000,032,636 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > |
22.08.2011, 12:18 | #8 |
/// Helfer-Team | Hilfe bundespolizei trojaner !!! 1. Fixen mit OTL
Code:
ATTFilter :OTL IE - HKLM\..\URLSearchHook: - Reg Error: Key error. File not found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - Reg Error: Key error. File not found IE - HKU\Onkel_ON_C\..\URLSearchHook: {e36df325-3f4b-476f-8f89-123bc5d51a30} - Reg Error: Key error. File not found :Reg [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{86D4B82A-ABED-442A-BE86-96357B70F4FE}" =- :Commands [purity] [emptytemp]
** kannst Du wieder normal starten? 2. läuft unter XP, Vista mit (32Bit) und Windows 7 (32Bit) Achtung!: WENN GMER NICHT AUSGEFÜHRT WERDEN KANN ODER PROBMLEME VERURSACHT, fahre mit dem nächsten Punkt fort!- Es ist NICHT sinnvoll einen zweiten Versuch zu starten! Um einen tieferen Einblick in dein System, um eine mögliche Infektion mit einem Rootkit/Info v.wikipedia.org) aufzuspüren, werden wir ein Tool - Gmer - einsetzen :
** keine Verbindung zu einem Netzwerk und Internet - WLAN nicht vergessen Wenn der Scan beendet ist, bitte alle Programme und Tools wieder aktivieren! Anleitung:-> GMER - Rootkit Scanner 3. Kontrolle mit MBR -t, ob Master Boot Record in Ordnung ist (MBR-Rootkit) Mit dem folgenden Tool prüfen wir, ob sich etwas Schädliches im Master Boot Record eingenistet hat.
Lade Dir Malwarebytes Anti-Malware von→ malwarebytes.org
__________________ Warnung!: Vorsicht beim Rechnungen per Email mit ZIP-Datei als Anhang! Kann mit einen Verschlüsselungs-Trojaner infiziert sein! Anhang nicht öffnen, in unserem Forum erst nachfragen! Sichere regelmäßig deine Daten, auf CD/DVD, USB-Sticks oder externe Festplatten, am besten 2x an verschiedenen Orten! Bitte diese Warnung weitergeben, wo Du nur kannst! |
Themen zu Hilfe bundespolizei trojaner !!! |
100 euro, abgesicherte, abgesicherten, ahnung, arten, ausprobiert, bezahlen, brauche, dankbar, dringend, einstellung, euro, kaspersky, laptop, modus, neu, profis, rechner, rescue, rescue cd, starte, starten, troja, trojaner, windows, zusammen |