Trojaner "System Repair, P1kAIMiG2Kb7Fz.exe", Desktop Schwarz, Programme und Dokumente weg

oliver_1 · 28.08.2011, 23:15

Hallo Team,
ich kämpfe seit einiger Zeit mit einem Trojaner. Ich versuche hier einem Freund zu helfen und komme offensichtlich an meine Grenzen. Er hat ein Programm heruntergeladen Namens System Repair. Das hat dann eine defekte Festplatte angezeigt und nach einem Neustart war der Desktop Schwarz, Programme und Dokumente weg.

Ich habe bereits mit der Kaspersky kav_rescue_10.iso das System gestartet und den Bösewicht entfernt, nicht aber seine Spuren.

Über Google habe ich euch dann gefunden.

Einen Uralter Symantec Antivirus habe ich gelöscht und noch keine neue Virensoftware installiert, bis ich hiermit fertig bin. Der Kaspersky Antivirus 2012 liegt dafür schon bereit.

Hier der Log vom OTL

Code:

ATTFilter

OTL logfile created on: 28.08.2011 23:35:07 - Run 1
OTL by OldTimer - Version 3.2.26.6     Folder = C:\Dokumente und Einstellungen\user\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 2,59 Gb Available Physical Memory | 86,51% Memory free
4,83 Gb Paging File | 4,59 Gb Available in Paging File | 94,95% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 232,44 Gb Total Space | 218,61 Gb Free Space | 94,05% Space Free | Partition Type: NTFS
Drive D: | 233,00 Gb Total Space | 210,84 Gb Free Space | 90,49% Space Free | Partition Type: HFS
Drive H: | 942,19 Mb Total Space | 889,86 Mb Free Space | 94,45% Space Free | Partition Type: FAT
 
Computer Name: IMAC-3A458B4186 | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.08.28 23:18:42 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\user\Desktop\OTL.exe
PRC - [2011.04.28 09:59:58 | 000,220,552 | -H-- | M] (Geek Software GmbH) -- C:\Programme\PDF24\pdf24.exe
PRC - [2011.02.18 17:37:16 | 000,037,664 | -H-- | M] (Apple Inc.) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
PRC - [2010.11.11 20:00:58 | 000,525,112 | -H-- | M] (Apple Inc.) -- C:\Programme\Boot Camp\Bootcamp.exe
PRC - [2010.11.11 20:00:58 | 000,193,848 | -H-- | M] () -- C:\WINDOWS\system32\AppleOSSMgr.exe
PRC - [2010.10.14 10:11:39 | 000,487,424 | -H-- | M] (Gadwin Systems, Inc) -- C:\Programme\Gadwin Systems\PrintScreen\PrintScreen.exe
PRC - [2010.10.06 17:21:34 | 000,099,640 | -H-- | M] (Apple Inc.) -- C:\WINDOWS\system32\AppleTimeSrv.exe
PRC - [2010.03.04 22:38:00 | 000,071,096 | -H-- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe
PRC - [2008.04.14 07:52:46 | 001,036,800 | -H-- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.02.06 12:32:14 | 000,067,872 | -H-- | M] () -- C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\zlib1.dll
MOD - [2010.11.11 20:00:58 | 000,193,848 | -H-- | M] () -- C:\WINDOWS\system32\AppleOSSMgr.exe
MOD - [2010.03.04 22:38:00 | 000,071,096 | -H-- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe
MOD - [2009.12.12 16:12:03 | 000,141,824 | -H-- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2009.02.27 17:41:26 | 000,311,296 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Stopped] --  -- (PEVSystemStart)
SRV - [2011.02.18 17:37:16 | 000,037,664 | -H-- | M] (Apple Inc.) [Auto | Running] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010.11.11 20:00:58 | 000,193,848 | -H-- | M] () [Auto | Running] -- C:\WINDOWS\system32\AppleOSSMgr.exe -- (AppleOSSMgr)
SRV - [2010.10.06 17:21:34 | 000,099,640 | -H-- | M] (Apple Inc.) [Auto | Running] -- C:\WINDOWS\system32\AppleTimeSrv.exe -- (AppleTimeSrv)
SRV - [2010.03.04 22:38:00 | 000,071,096 | -H-- | M] () [Auto | Running] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccess)
SRV - [2010.01.09 22:37:50 | 004,640,000 | -H-- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 22:18:00 | 000,149,352 | -H-- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2010.11.11 20:00:58 | 000,049,280 | -H-- | M] (Apple Inc.) [File_System | Boot | Running] -- C:\WINDOWS\System32\drivers\AppleHFS.sys -- (AppleHFS)
DRV - [2010.11.11 20:00:58 | 000,006,784 | -H-- | M] (Apple Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\AppleMNT.sys -- (AppleMNT)
DRV - [2010.11.11 20:00:58 | 000,006,528 | -H-- | M] (Apple Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\KeyAgent.sys -- (KeyAgent)
DRV - [2010.09.17 18:26:24 | 000,030,208 | -H-- | M] (Cirrus Logic) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\clhdaud.sys -- (HdAudAddService)
DRV - [2010.09.17 18:26:14 | 000,222,248 | -H-- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k)
DRV - [2010.09.17 18:26:04 | 000,034,304 | -H-- | M] (Apple Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\applebmt.sys -- (applebmt)
DRV - [2010.09.17 18:25:46 | 000,024,064 | -H-- | M] (Apple Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\KeyMagic.sys -- (KeyMagic)
DRV - [2010.09.17 18:25:41 | 000,018,432 | -H-- | M] (Apple Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AppleBtBc.sys -- (AppleBtBc)
DRV - [2010.09.15 14:36:49 | 000,101,904 | -H-- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2010.09.15 14:36:47 | 004,688,384 | -H-- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2010.08.10 03:01:19 | 001,590,528 | -H-- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)
DRV - [2010.08.10 03:01:03 | 000,016,512 | -H-- | M] (Apple Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\IRFilter.sys -- (IRRemoteFlt)
DRV - [2010.08.05 12:17:56 | 000,012,928 | -H-- | M] (Apple Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\MacHALDriver.sys -- (MacHALDriver)
DRV - [2009.11.12 13:48:56 | 000,007,168 | -H-- | M] () [File_System | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.04.15 14:54:59 | 000,000,000 | -H-D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.04.15 16:52:02 | 000,000,000 | -H-D | M]
 
[2011.04.15 14:55:04 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Extensions
[2011.07.02 12:36:57 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\p78a2n2u.default\extensions
[2011.07.02 12:36:57 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Mozilla\Firefox\Profiles\p78a2n2u.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.07.02 12:36:57 | 000,000,000 | -H-D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.03.03 20:06:04 | 000,001,392 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.03.03 20:06:04 | 000,002,344 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011.03.03 20:06:04 | 000,006,805 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.03.03 20:06:04 | 000,001,178 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.03.03 20:06:04 | 000,001,105 | -H-- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.02.28 14:00:00 | 000,000,820 | -H-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apple_KbdMgr] C:\Programme\Boot Camp\Bootcamp.exe (Apple Inc.)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [PDFPrint] C:\Programme\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKCU..\Run: [Gadwin PrintScreen] C:\Programme\Gadwin Systems\PrintScreen\PrintScreen.exe (Gadwin Systems, Inc)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: An OneNote s&enden - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Programme\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKCU\..Trusted Domains: ferrari.com ([www.crm] http in Vertrauenswürdige Sites)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1300026916526 (MUWebControl Class)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.03.12 17:30:47 | 000,000,000 | -H-- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{330267f0-4d6b-11e0-ae68-40a6d9f5a0d7}\Shell - "" = AutoRun
O33 - MountPoints2\{330267f0-4d6b-11e0-ae68-40a6d9f5a0d7}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{330267f0-4d6b-11e0-ae68-40a6d9f5a0d7}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{cc61498b-4cc4-11e0-ae63-8c0cd93853f4}\Shell - "" = AutoRun
O33 - MountPoints2\{cc61498b-4cc4-11e0-ae63-8c0cd93853f4}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{cc61498b-4cc4-11e0-ae63-8c0cd93853f4}\Shell\AutoRun\command - "" = "G:\WD SmartWare.exe" autoplay=true
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.08.28 23:34:44 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\user\Desktop\OTL.exe
[2011.08.28 23:28:52 | 000,000,000 | --SD | C] -- C:\cofi
[2011.08.28 22:56:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2011.08.24 21:26:57 | 000,000,000 | --SD | C] -- C:\ComboFix
[2011.08.24 20:00:38 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011.08.24 20:00:38 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011.08.24 20:00:38 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011.08.24 20:00:38 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011.08.24 20:00:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011.08.24 19:55:57 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011.08.24 19:55:55 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\user\Startmenü\Programme\Verwaltung
[2011.08.24 19:55:55 | 000,000,000 | R--D | C] -- C:\Dokumente und Einstellungen\user\Eigene Dateien\Eigene Videos
[2011.08.24 19:44:29 | 000,000,000 | ---D | C] -- C:\Programme\Trend Micro
[2011.08.24 19:22:16 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy
[2011.08.24 19:22:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
[2011.08.24 19:19:31 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\user\Recent
[2011.08.24 19:09:31 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Malwarebytes
[2011.08.24 17:10:11 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.08.24 16:15:00 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2011.08.24 11:48:02 | 000,043,904 | -H-- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sbp2port.sys
[2011.08.17 15:34:57 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\user\Startmenü\Programme\System Repair
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.08.28 23:33:47 | 000,013,646 | -H-- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.08.28 23:33:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.08.28 23:18:42 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\user\Desktop\OTL.exe
[2011.08.17 15:37:28 | 000,000,384 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\P1kAlMiG2Kb7Fz
[2011.08.17 15:34:57 | 000,000,855 | -H-- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\System Repair.lnk
[2011.08.17 15:34:57 | 000,000,240 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~P1kAlMiG2Kb7Fz
[2011.08.17 15:34:57 | 000,000,192 | -H-- | M] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~P1kAlMiG2Kb7Fzr
[2011.08.17 07:19:06 | 000,002,593 | ---- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\Microsoft Outlook 2010.lnk
[2011.08.16 16:06:12 | 000,217,342 | -H-- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\kunde.JPG
[2011.08.12 09:52:00 | 000,000,276 | -H-- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011.08.03 15:42:45 | 000,476,160 | -H-- | M] () -- C:\Dokumente und Einstellungen\user\Desktop\pirelli preis.msg
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.08.24 20:00:38 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011.08.24 20:00:38 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011.08.24 20:00:38 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011.08.24 20:00:38 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011.08.24 20:00:38 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011.08.17 15:34:57 | 000,000,855 | -H-- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\System Repair.lnk
[2011.08.17 15:34:57 | 000,000,240 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~P1kAlMiG2Kb7Fz
[2011.08.17 15:34:57 | 000,000,192 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\~P1kAlMiG2Kb7Fzr
[2011.08.17 15:34:55 | 000,000,384 | -H-- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\P1kAlMiG2Kb7Fz
[2011.08.16 16:06:12 | 000,217,342 | -H-- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\kunde.JPG
[2011.08.03 15:42:45 | 000,476,160 | -H-- | C] () -- C:\Dokumente und Einstellungen\user\Desktop\pirelli preis.msg
[2011.04.15 14:55:02 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\nsreg.dat
[2011.04.15 14:08:10 | 000,007,168 | -H-- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2011.04.15 12:21:19 | 000,014,848 | -H-- | C] () -- C:\Dokumente und Einstellungen\user\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.03.13 12:12:58 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\ativpsrm.bin
[2011.03.13 12:12:48 | 000,887,724 | -H-- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2011.03.13 12:12:48 | 000,045,056 | -H-- | C] () -- C:\WINDOWS\System32\ATIODCLI.exe
[2011.03.13 12:12:47 | 000,294,912 | -H-- | C] () -- C:\WINDOWS\System32\ATIODE.exe
[2011.03.13 12:12:47 | 000,202,234 | -H-- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2011.03.13 12:12:47 | 000,000,003 | -H-- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2011.03.12 17:32:13 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2011.03.12 17:28:16 | 000,021,740 | -H-- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2011.03.12 16:36:36 | 000,004,161 | -H-- | C] () -- C:\WINDOWS\ODBCINST.INI
[2011.03.12 16:35:32 | 000,192,976 | -H-- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.11.11 20:00:58 | 000,193,848 | -H-- | C] () -- C:\WINDOWS\System32\AppleOSSMgr.exe
[2008.04.14 08:06:26 | 000,001,804 | -H-- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2006.12.31 07:57:08 | 000,004,569 | -H-- | C] () -- C:\WINDOWS\System32\secupd.dat
[2006.02.28 14:00:00 | 013,107,200 | -H-- | C] () -- C:\WINDOWS\System32\oembios.bin
[2006.02.28 14:00:00 | 000,673,088 | -H-- | C] () -- C:\WINDOWS\System32\mlang.dat
[2006.02.28 14:00:00 | 000,452,236 | -H-- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2006.02.28 14:00:00 | 000,435,396 | -H-- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2006.02.28 14:00:00 | 000,272,128 | -H-- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2006.02.28 14:00:00 | 000,269,480 | -H-- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2006.02.28 14:00:00 | 000,218,003 | -H-- | C] () -- C:\WINDOWS\System32\dssec.dat
[2006.02.28 14:00:00 | 000,081,300 | -H-- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2006.02.28 14:00:00 | 000,068,292 | -H-- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2006.02.28 14:00:00 | 000,046,258 | -H-- | C] () -- C:\WINDOWS\System32\mib.bin
[2006.02.28 14:00:00 | 000,034,478 | -H-- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2006.02.28 14:00:00 | 000,028,626 | -H-- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2006.02.28 14:00:00 | 000,004,461 | -H-- | C] () -- C:\WINDOWS\System32\oembios.dat
[2006.02.28 14:00:00 | 000,000,741 | -H-- | C] () -- C:\WINDOWS\System32\noise.dat
 
========== LOP Check ==========
 
[2011.04.15 14:08:16 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited
[2011.03.13 17:03:54 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2011.04.15 14:08:16 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\Canneverbe Limited
[2011.05.07 10:56:33 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\STAR
[2011.03.13 16:54:42 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\user\Anwendungsdaten\TeamViewer
 
========== Purity Check ==========
 
 

< End of report >

Hier der Log Extras vom OTL

Code:

ATTFilter

OTL Extras logfile created on: 28.08.2011 23:35:07 - Run 1
OTL by OldTimer - Version 3.2.26.6     Folder = C:\Dokumente und Einstellungen\user\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,99 Gb Total Physical Memory | 2,59 Gb Available Physical Memory | 86,51% Memory free
4,83 Gb Paging File | 4,59 Gb Available in Paging File | 94,95% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 232,44 Gb Total Space | 218,61 Gb Free Space | 94,05% Space Free | Partition Type: NTFS
Drive D: | 233,00 Gb Total Space | 210,84 Gb Free Space | 90,49% Space Free | Partition Type: HFS
Drive H: | 942,19 Mb Total Space | 889,86 Mb Free Space | 94,45% Space Free | Partition Type: FAT
 
Computer Name: IMAC-3A458B4186 | User Name: user | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
"AntiVirusDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\Microsoft Office\Office14\ONENOTE.EXE" = C:\Programme\Microsoft Office\Office14\ONENOTE.EXE:*:Enabled:Microsoft OneNote -- (Microsoft Corporation)
"C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE" = C:\Programme\Microsoft Office\Office14\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)
"C:\Programme\TeamViewer\Version5\TeamViewer.exe" = C:\Programme\TeamViewer\Version5\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe" = C:\Programme\TeamViewer\Version5\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service -- (TeamViewer GmbH)
"G:\pen\Apache2\bin\Apache.exe" = G:\pen\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server
"G:\pen\mysql\bin\mysqld.exe" = G:\pen\mysql\bin\mysqld.exe:*:Enabled:mysqld
"H:\pen\Apache2\bin\Apache.exe" = H:\pen\Apache2\bin\Apache.exe:*:Enabled:Apache HTTP Server
"H:\pen\mysql\bin\mysqld.exe" = H:\pen\mysql\bin\mysqld.exe:*:Enabled:mysqld
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{2A697B53-0DE3-42DA-B41D-C3F804B1C538}" = iTunes
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1" = PDF24 Creator 3.0.0
"{90140000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 14
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.3 - Deutsch
"{AC76BA86-7AD7-5760-0000-900000000003}" = Japanese Fonts Support For Adobe Reader 9
"{B56ACF7B-D7B5-442B-8E1D-6B41347D88B2}" = Boot Camp-Dienste
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"059B155261B840AB89EA7581CAFC636EEB1D4364" = Windows-Treiberpaket - Atheros (AR5416) Net  (11/18/2009 7.7.0.429)
"065B919FD23D12E588F6E2BFB21F7836E2F0E704" = Windows-Treiberpaket - Intel Net  (07/16/2008 9.52.10.0)
"10D2BC6E46256E5119E70339886763898529B437" = Windows-Treiberpaket - Apple Inc. Apple Keyboard (03/24/2010 3.1.0.3)
"111E266FDD1556398EFC13BE47678F96E8497682" = Windows-Treiberpaket - Apple Inc. Apple Trackpad Enabler (07/13/2009 3.0.0.1)
"1E934494E1FDB938ED1D9B958D5D5D465A07F06A" = Windows-Treiberpaket - Intel Net  (08/05/2008 10.3.49.0)
"2AC97D2605162B73D046D68013D1030CB7CFB87E" = Windows-Treiberpaket - Intel Net  (01/08/2008 8.3.9.0)
"2E2B6DCC02509BB8D2629A009DE8B5C3055B6779" = Windows-Treiberpaket - Apple Inc. Apple ODD (05/17/2010 3.1.0.0)
"31BC243044B2C02B454ECDA8F5B44427F3754DD0" = Windows-Treiberpaket - Apple Inc. (applebt) Bluetooth  (03/01/2010 3.0.0.5)
"4D00971668041EDAD7097C5827D1739F03B9E5D7" = Windows-Treiberpaket - Apple Inc. Apple IR Receiver (02/21/2008 2.0.4.0)
"5A9DF61C17938C73DCC75C9B4B3A4DE3C74D38ED" = Windows-Treiberpaket - Apple Inc. Apple Multitouch Mouse (02/11/2010 3.1.0.0)
"5D1F13EEF9A42CC17001EAFFC701D57AF8D13E9D" = Windows-Treiberpaket - Apple Inc. Apple Broadcom Bluetooth (03/01/2010 3.1.0.3)
"5F8BE32FAE3D6BC77B512F7B0624D7B6C8A26EFB" = Windows-Treiberpaket - Apple Inc. Apple Bluetooth Enabler (06/27/2007 2.0.0.1)
"60B5F87397EB801AB1BAB3E940CE0E077830B153" = Windows-Treiberpaket - Apple Inc. Apple Multitouch (02/11/2010 3.1.0.0)
"627745F8E8BB901B043047C3E308B4A76C1194FE" = Windows-Treiberpaket - Intel (E1000) Net  (11/07/2007 8.10.1.0)
"675AAC36E980D647C94EAFFB2F929F247E711708" = Windows-Treiberpaket - Intel (e1kexpress) Net  (07/22/2008 10.3.45.0)
"6AB59209597E0F6B986EC8E976521FDF0A696C9D" = Windows-Treiberpaket - Marvell (yukonwxp) Net  (03/23/2007 10.12.7.3)
"6B506C173C124C3226C93DAD288A912087624C69" = Windows-Treiberpaket - Broadcom (b57w2k) Net  (02/09/2010 14.0.0.7)
"78C67451B87511098A9A0EC86E75B99B12298F5C" = Windows-Treiberpaket - Intel (e1express) Net  (02/06/2008 9.12.18.0)
"7BD968405DE73C7E0F8E489DB5A5853A6CCB8D1D" = Windows-Treiberpaket - Intel (e1qexpress) Net  (08/05/2008 10.3.49.0)
"7-Zip" = 7-Zip 4.65
"82BE89CA9B7493FA05D2D4D32B415CF07EA08B47" = Windows-Treiberpaket - Intel System  (07/20/2007 1.2.76.0)
"9324ED54E32F5399037F87E076CA01C6CEB92830" = Windows-Treiberpaket - Apple Inc. Apple Built-in iSight (10/25/2007 2.0.1.0)
"9747248FCA6A074E791AABC17F527823A8225756" = Windows-Treiberpaket - Intel Net  (07/22/2008 10.3.45.0)
"A06888013552B918232820F81FDBA706F5CAAD39" = Windows-Treiberpaket - Intel (e1yexpress) Net  (06/13/2008 9.52.9.0)
"A0DAD483951AB3046050D68A2A1D8CEB4A7C61EE" = Windows-Treiberpaket - Apple Inc. Apple Trackpad (07/13/2009 3.0.0.1)
"A7A7D84907D2DCB34930D77C6BA911E3834C1E34" = Windows-Treiberpaket - Apple Inc. Apple Multitouch Mouse (10/05/2010 3.2.0.1)
"AD3493E108434977125BBF78F47699626F8AF64B" = Windows-Treiberpaket - Apple Inc. (AppleUSBEthernet) Net  (01/11/2008 3.4.3.18)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"AEB482706002E9220FBFB86D4A1D24257F71A3D4" = Windows-Treiberpaket - Apple Inc. Apple Multitouch (10/05/2010 3.2.0.1)
"B345101E6CC8B2FD9765620B9C7BCD3D7002BE6D" = Windows-Treiberpaket - Intel Net  (02/06/2008 9.12.17.0)
"B4AC4F962DDC0DD6B71FCF20B8F2F694214FAE69" = Windows-Treiberpaket - Apple Inc. Apple ODD (01/17/2008 2.0.2.2)
"C5CE3BA75A23622D2140C5D5D0998C07DDC4CF1C" = Windows-Treiberpaket - Apple Inc. Apple Display (01/23/2009 3.0.0.0)
"CFC3D985EA69596C8BE0A30313010FCC8CE2C70F" = Windows-Treiberpaket - Apple Inc. Apple Wireless Trackpad (08/24/2010 3.1.0.7)
"DE32692B1421420518B0CA8EEDD6DF2A494F279F" = Windows-Treiberpaket - Apple Inc. Apple Wireless Mouse (11/30/2009 3.0.0.6)
"E0C32821F1E2CE3EB89C177BEA1AEF6558D681D9" = Windows-Treiberpaket - Apple Inc. Apple Wireless Trackpad (04/12/2010 3.1.0.5)
"E90BBBBF2BC7869A101909EA920E455DC7354A38" = Windows-Treiberpaket - Broadcom (BCM43XX) Net  (08/25/2009 5.60.18.9)
"F24CB85E5983448F6319803791DEACED91E6565B" = Windows-Treiberpaket - Apple Inc. System  (08/22/2008 2.1.1.1)
"F7D4BBE83ED347867851C05163103672591D5E3C" = Windows-Treiberpaket - CirrusLogic (HdAudAddService) MEDIA  (04/28/2010 1.0.0.32)
"Gadwin PrintScreen" = Gadwin PrintScreen
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.15)" = Mozilla Firefox (3.6.15)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"Office14.SingleImage" = Microsoft Office Home and Business 2010
"TeamViewer 5" = TeamViewer 5
"VLC media player" = VLC media player 1.1.7
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >

Hier der Log vom ccleaner

Code:

ATTFilter

7-Zip 4.65		28.08.2011		
Adobe AIR	Adobe Systems Inc.	13.03.2011		2.5.1.17730
Adobe Flash Player 10 ActiveX	Adobe Systems Incorporated	28.08.2011		10.2.159.1
Adobe Flash Player 10 Plugin	Adobe Systems Incorporated	28.08.2011		10.2.152.26
Adobe Reader 9.4.3 - Deutsch	Adobe Systems Incorporated	15.04.2011	245MB	9.4.3
Adobe Shockwave Player 11.5	Adobe Systems, Inc.	28.08.2011		11.5.9.620
Adobe SVG Viewer 3.0		28.08.2011		 3.0
Apple Application Support	Apple Inc.	13.03.2011	52,7MB	1.5.0
Apple Mobile Device Support	Apple Inc.	13.03.2011	21,8MB	3.4.0.25
Apple Software Update	Apple Inc.	13.03.2011	2,16MB	2.1.1.116
Bonjour	Apple Inc.	13.03.2011	1,06MB	2.0.4.0
Boot Camp-Dienste	Apple Inc.	13.03.2011	9,29MB	3.2.0
CCleaner	Piriform	28.08.2011		3.09
CDBurnerXP	CDBurnerXP	15.04.2011		4.3.0.1991
Gadwin PrintScreen	Gadwin Systems, Inc.	28.08.2011		4.5
Hotfix für Windows XP (KB969084)	Microsoft Corporation	12.03.2011		3
iTunes	Apple Inc.	13.03.2011	143,0MB	10.2.1.1
Japanese Fonts Support For Adobe Reader 9	Adobe Systems Incorporated	28.07.2011	16,5MB	9.0.0
Microsoft .NET Framework 2.0 Service Pack 2	Microsoft Corporation	15.04.2011	1.014MB	2.2.30729
Microsoft .NET Framework 3.0 Service Pack 2	Microsoft Corporation	13.03.2011	311MB	3.2.30729
Microsoft .NET Framework 3.5 SP1	Microsoft Corporation	13.03.2011		
Microsoft Compression Client Pack 1.0 for Windows XP	Microsoft Corporation	12.03.2011		1
Microsoft Office Home and Business 2010	Microsoft Corporation	28.08.2011		14.0.4763.1000
Microsoft User-Mode Driver Framework Feature Pack 1.0	Microsoft Corporation	12.03.2011		
Mozilla Firefox (3.6.15)	Mozilla	28.08.2011		3.6.15 (de)
PDF24 Creator 3.0.0	PDF24.org	03.05.2011		
QuickTime	Apple Inc.	13.03.2011	73,7MB	7.69.80.9
Realtek High Definition Audio Driver	Realtek Semiconductor Corp.	13.03.2011		5.10.0.5936
TeamViewer 5	TeamViewer GmbH	28.08.2011		5.1.9385 
VLC media player 1.1.7	VideoLAN	28.08.2011		1.1.7
Windows Genuine Advantage Validation Tool (KB892130)	Microsoft Corporation	13.03.2011		
Windows Media Format 11 runtime		28.08.2011		
Windows Media Player 11		28.08.2011		
Windows-Treiberpaket - Apple Inc. (applebt) Bluetooth  (03/01/2010 3.0.0.5)	Apple Inc.	28.08.2011		03/01/2010 3.0.0.5
Windows-Treiberpaket - Apple Inc. (AppleUSBEthernet) Net  (01/11/2008 3.4.3.18)	Apple Inc.	28.08.2011		01/11/2008 3.4.3.18
Windows-Treiberpaket - Apple Inc. Apple Bluetooth Enabler (06/27/2007 2.0.0.1)	Apple Inc.	28.08.2011		06/27/2007 2.0.0.1
Windows-Treiberpaket - Apple Inc. Apple Broadcom Bluetooth (03/01/2010 3.1.0.3)	Apple Inc.	28.08.2011		03/01/2010 3.1.0.3
Windows-Treiberpaket - Apple Inc. Apple Built-in iSight (10/25/2007 2.0.1.0)	Apple Inc.	28.08.2011		10/25/2007 2.0.1.0
Windows-Treiberpaket - Apple Inc. Apple Display (01/23/2009 3.0.0.0)	Apple Inc.	28.08.2011		01/23/2009 3.0.0.0
Windows-Treiberpaket - Apple Inc. Apple IR Receiver (02/21/2008 2.0.4.0)	Apple Inc.	28.08.2011		02/21/2008 2.0.4.0
Windows-Treiberpaket - Apple Inc. Apple Keyboard (03/24/2010 3.1.0.3)	Apple Inc.	28.08.2011		03/24/2010 3.1.0.3
Windows-Treiberpaket - Apple Inc. Apple Multitouch (02/11/2010 3.1.0.0)	Apple Inc.	28.08.2011		02/11/2010 3.1.0.0
Windows-Treiberpaket - Apple Inc. Apple Multitouch (10/05/2010 3.2.0.1)	Apple Inc.	28.08.2011		10/05/2010 3.2.0.1
Windows-Treiberpaket - Apple Inc. Apple Multitouch Mouse (02/11/2010 3.1.0.0)	Apple Inc.	28.08.2011		02/11/2010 3.1.0.0
Windows-Treiberpaket - Apple Inc. Apple Multitouch Mouse (10/05/2010 3.2.0.1)	Apple Inc.	28.08.2011		10/05/2010 3.2.0.1
Windows-Treiberpaket - Apple Inc. Apple ODD (01/17/2008 2.0.2.2)	Apple Inc.	28.08.2011		01/17/2008 2.0.2.2
Windows-Treiberpaket - Apple Inc. Apple ODD (05/17/2010 3.1.0.0)	Apple Inc.	28.08.2011		05/17/2010 3.1.0.0
Windows-Treiberpaket - Apple Inc. Apple Trackpad (07/13/2009 3.0.0.1)	Apple Inc.	28.08.2011		07/13/2009 3.0.0.1
Windows-Treiberpaket - Apple Inc. Apple Trackpad Enabler (07/13/2009 3.0.0.1)	Apple Inc.	28.08.2011		07/13/2009 3.0.0.1
Windows-Treiberpaket - Apple Inc. Apple Wireless Mouse (11/30/2009 3.0.0.6)	Apple Inc.	28.08.2011		11/30/2009 3.0.0.6
Windows-Treiberpaket - Apple Inc. Apple Wireless Trackpad (04/12/2010 3.1.0.5)	Apple Inc.	28.08.2011		04/12/2010 3.1.0.5
Windows-Treiberpaket - Apple Inc. Apple Wireless Trackpad (08/24/2010 3.1.0.7)	Apple Inc.	28.08.2011		08/24/2010 3.1.0.7
Windows-Treiberpaket - Apple Inc. System  (08/22/2008 2.1.1.1)	Apple Inc.	28.08.2011		08/22/2008 2.1.1.1
Windows-Treiberpaket - Atheros (AR5416) Net  (11/18/2009 7.7.0.429)	Atheros	28.08.2011		11/18/2009 7.7.0.429
Windows-Treiberpaket - Broadcom (b57w2k) Net  (02/09/2010 14.0.0.7)	Broadcom	28.08.2011		02/09/2010 14.0.0.7
Windows-Treiberpaket - Broadcom (BCM43XX) Net  (08/25/2009 5.60.18.9)	Broadcom	28.08.2011		08/25/2009 5.60.18.9
Windows-Treiberpaket - CirrusLogic (HdAudAddService) MEDIA  (04/28/2010 1.0.0.32)	CirrusLogic	28.08.2011		04/28/2010 1.0.0.32
Windows-Treiberpaket - Intel (E1000) Net  (11/07/2007 8.10.1.0)	Intel	28.08.2011		11/07/2007 8.10.1.0
Windows-Treiberpaket - Intel (e1express) Net  (02/06/2008 9.12.18.0)	Intel	28.08.2011		02/06/2008 9.12.18.0
Windows-Treiberpaket - Intel (e1kexpress) Net  (07/22/2008 10.3.45.0)	Intel	28.08.2011		07/22/2008 10.3.45.0
Windows-Treiberpaket - Intel (e1qexpress) Net  (08/05/2008 10.3.49.0)	Intel	28.08.2011		08/05/2008 10.3.49.0
Windows-Treiberpaket - Intel (e1yexpress) Net  (06/13/2008 9.52.9.0)	Intel	28.08.2011		06/13/2008 9.52.9.0
Windows-Treiberpaket - Intel Net  (01/08/2008 8.3.9.0)	Intel	28.08.2011		01/08/2008 8.3.9.0
Windows-Treiberpaket - Intel Net  (02/06/2008 9.12.17.0)	Intel	28.08.2011		02/06/2008 9.12.17.0
Windows-Treiberpaket - Intel Net  (07/16/2008 9.52.10.0)	Intel	28.08.2011		07/16/2008 9.52.10.0
Windows-Treiberpaket - Intel Net  (07/22/2008 10.3.45.0)	Intel	28.08.2011		07/22/2008 10.3.45.0
Windows-Treiberpaket - Intel Net  (08/05/2008 10.3.49.0)	Intel	28.08.2011		08/05/2008 10.3.49.0
Windows-Treiberpaket - Intel System  (07/20/2007 1.2.76.0)	Intel	28.08.2011		07/20/2007 1.2.76.0
Windows-Treiberpaket - Marvell (yukonwxp) Net  (03/23/2007 10.12.7.3)	Marvell	28.08.2011		03/23/2007 10.12.7.3
WinRAR archiver		28.08.2011

Trojaner "System Repair, P1kAIMiG2Kb7Fz.exe", Desktop Schwarz, Programme und Dokumente weg

Log-Analyse und Auswertung: Trojaner "System Repair, P1kAIMiG2Kb7Fz.exe", Desktop Schwarz, Programme und Dokumente weg

Trojaner "System Repair, P1kAIMiG2Kb7Fz.exe", Desktop Schwarz, Programme und Dokumente weg

Ähnliche Themen: Trojaner "System Repair, P1kAIMiG2Kb7Fz.exe", Desktop Schwarz, Programme und Dokumente weg