Morgen miteinander.

So mein erster Post und gleich mit einer Problemstellung. Beim Systemstart erscheint die Fehlermeldung "activexdebugger32.exe konnte nicht gefunden". Jetzt hab ich mal gegoogelt und musste feststellen dass ich mir dat Dingens per infizierten USB Stick eingefangen habe.

Jetzt ist stellt sich die Frage wer möchte mit mir diesen Virus bekämpfen und mit Rat und Tat zur Seite stehen?

Auf geht's - Freiwillige vor !

Vielen Dank,

kabafreak

Bitte nun routinemäßig einen Vollscan mit Malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Hallo. Hat etwas länger gedauert - pro Scandurchgang ca. 7 Stunden

Habe bis jetzt folgende Programme durchlaufen lassen: Adaware, SpyBot, Norman, Panda Online.
Alle bisher mit negativen Ergebnissen

Hier ist der Log von Anti-Malware:

--------------------------------

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8322

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

07.12.2011 08:34:26
mbam-log-2011-12-07 (08-34-26).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 744506
Laufzeit: 4 Stunde(n), 27 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 4
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (Explorer.exe activexdebugger32.exe) Good: (Explorer.exe) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

--------------------------------

Der Eset Log folgt.

Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.

Erstmal die restlichen Malewarebytes-Logs:

10:41:10 Admin MESSAGE Protection started successfully
10:41:15 Admin MESSAGE IP Protection started successfully
13:46:02 Admin MESSAGE Protection started successfully
13:46:07 Admin MESSAGE IP Protection started successfully
14:06:35 Admin MESSAGE IP Protection stopped
14:06:39 Admin MESSAGE Database updated successfully
14:06:41 Admin MESSAGE IP Protection started successfully
20:23:36 Admin ERROR Scheduled update failed: No address found failed with error code 11004



08:36:18 Admin MESSAGE Protection started successfully
08:36:22 Admin MESSAGE IP Protection started successfully
08:47:43 Admin MESSAGE IP Protection stopped



Und nun der Eset-Log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# IEXPLORE.EXE=7.00.6000.17103 (vista_gdr.110816-1000)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=be729ab067c078499053869f770f5b64
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-12-07 12:08:22
# local_time=2011-12-07 01:08:22 (+0100, Westeuropäische Normalzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=5378 16777173 100 71 4313 158530670 0 0
# compatibility_mode=8192 67108863 100 0 3717 3717 0 0
# scanned=575825
# found=0
# cleaned=0
# scan_time=15624

CustomScan mit OTL

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die OTL.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Kopiere nun den kompletten Inhalt aus der untenstehenden Codebox in die Textbox von OTL - wenn OTL auf deutsch ist wird sie mit beschriftet

netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Klick auf .
• Kopiere nun den Inhalt aus OTL.txt hier in Deinen Thread

Hier nun der OTL-Log:

OTL logfile created on: 07.12.2011 13:50:33 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = C:\Dokumente und Einstellungen\Admin\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,60 Gb Available Physical Memory | 86,66% Memory free
4,84 Gb Paging File | 4,60 Gb Available in Paging File | 95,11% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 465,65 Gb Total Space | 43,61 Gb Free Space | 9,37% Space Free | Partition Type: NTFS
Drive R: | 50,00 Gb Total Space | 21,73 Gb Free Space | 43,45% Space Free | Partition Type: NTFS
Drive S: | 2048,00 Gb Total Space | 1104,69 Gb Free Space | 53,94% Space Free | Partition Type: NTFS
Drive T: | 2048,00 Gb Total Space | 231,02 Gb Free Space | 11,28% Space Free | Partition Type: NTFS
Drive Y: | 50,00 Gb Total Space | 21,73 Gb Free Space | 43,45% Space Free | Partition Type: NTFS
 
Computer Name: SCHNITT2 | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.12.07 13:48:51 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Admin\Desktop\OTL.exe
PRC - [2011.06.09 12:06:06 | 000,254,696 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
PRC - [2010.12.17 15:22:48 | 000,288,072 | ---- | M] (Norman ASA) -- C:\NORMAN\Nse\Bin\Nsesvc.exe
PRC - [2009.10.06 15:16:08 | 000,266,912 | ---- | M] (Norman ASA) -- C:\NORMAN\npm\Bin\Njeeves.exe
PRC - [2009.10.06 14:23:30 | 000,275,840 | ---- | M] (Norman ASA) -- C:\NORMAN\npm\Bin\Zlh.exe
PRC - [2009.10.06 14:22:58 | 000,411,016 | ---- | M] (Norman ASA) -- C:\NORMAN\npm\Bin\Zanda.exe
PRC - [2009.10.06 14:07:14 | 000,148,808 | ---- | M] (Norman ASA) -- C:\NORMAN\nvc\bin\Nvcsched.exe
PRC - [2009.10.06 13:12:02 | 000,144,712 | ---- | M] (Norman ASA) -- C:\NORMAN\nvc\bin\CClaw.exe
PRC - [2009.10.06 13:06:56 | 000,185,672 | ---- | M] (Norman ASA) -- C:\NORMAN\nvc\bin\Nvcoas.exe
PRC - [2009.10.06 12:55:02 | 000,152,904 | ---- | M] (Norman ASA) -- C:\NORMAN\npm\Bin\elogsvc.exe
PRC - [2008.04.14 06:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2007.03.21 12:00:04 | 000,355,096 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2007.03.21 12:00:00 | 000,174,872 | ---- | M] (Intel Corporation) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe
 
 
========== Modules (No Company Name) ==========
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2010.12.17 15:22:48 | 000,288,072 | ---- | M] (Norman ASA) [On_Demand | Running] -- C:\NORMAN\Nse\bin\NSESVC.EXE -- (nsesvc)
SRV - [2009.10.06 15:16:08 | 000,266,912 | ---- | M] (Norman ASA) [On_Demand | Running] -- C:\NORMAN\npm\Bin\Njeeves.exe -- (Norman NJeeves)
SRV - [2009.10.06 14:22:58 | 000,411,016 | ---- | M] (Norman ASA) [Auto | Running] -- C:\NORMAN\npm\bin\zanda.exe -- (Norman ZANDA)
SRV - [2009.10.06 14:07:14 | 000,148,808 | ---- | M] (Norman ASA) [On_Demand | Running] -- C:\NORMAN\nvc\bin\Nvcsched.exe -- (NVCScheduler)
SRV - [2009.10.06 13:06:56 | 000,185,672 | ---- | M] (Norman ASA) [On_Demand | Running] -- C:\NORMAN\Nvc\bin\nvcoas.exe -- (nvcoas)
SRV - [2009.10.06 12:55:02 | 000,152,904 | ---- | M] (Norman ASA) [Auto | Running] -- C:\NORMAN\Npm\bin\ELOGSVC.EXE -- (eLoggerSvc6)
SRV - [2007.03.21 12:00:04 | 000,355,096 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2003.07.28 10:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2009.10.13 11:24:28 | 000,024,168 | ---- | M] (Norman ASA) [Kernel | Auto | Running] -- C:\NORMAN\Nse\Bin\Ndiskio.sys -- (Ndiskio)
DRV - [2009.10.09 09:22:10 | 000,021,832 | ---- | M] (Norman ASA) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvcw32mf.sys -- (NvcMFlt)
DRV - [2009.10.07 13:34:30 | 000,025,032 | ---- | M] (Norman ASA) [Kernel | System | Running] -- c:\NORMAN\nvc\bin\ngs.sys -- (NGS)
DRV - [2009.06.30 10:37:16 | 000,028,552 | ---- | M] (Panda Security, S.L.) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\pavboot.sys -- (pavboot)
DRV - [2008.07.28 11:04:30 | 000,004,096 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bbcap.sys -- (bbcap)
DRV - [2007.05.25 04:35:32 | 000,137,728 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\mv61xx.sys -- (mv61xx)
DRV - [2007.04.23 11:12:28 | 004,402,176 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006.11.22 07:01:00 | 000,250,496 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2005.01.10 11:45:56 | 000,011,264 | ---- | M] (VOB Computersysteme GmbH) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\asapiW2k.sys -- (ASAPIW2K)
DRV - [2004.08.13 19:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.main.tv/"
FF - prefs.js..extensions.enabledItems: {b9db16a4-6edc-47ec-a1f4-b86292ed211d}:4.9.6
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@pandasecurity.com/activescan: C:\Programme\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security, S.L.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.11.14 14:32:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.12.01 15:16:03 | 000,000,000 | ---D | M]
 
[2008.09.03 12:11:46 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Extensions
[2011.12.01 18:34:23 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\bfl90s9c.default\extensions
[2011.11.07 13:03:15 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla\Firefox\Profiles\bfl90s9c.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2011.12.05 16:05:02 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010.12.06 09:32:57 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.03.08 09:57:21 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011.07.13 11:27:34 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
[2011.10.27 08:57:53 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
[2009.07.28 08:05:31 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2011.03.15 18:40:01 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.03.15 18:40:01 | 000,002,344 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011.03.15 18:40:01 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.03.15 18:40:01 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.03.15 18:40:01 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004.08.04 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.7018.1622\swg.dll (Google Inc.)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [Norman ZANDA] C:\NORMAN\Npm\bin\ZLH.EXE (Norman ASA)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\\PSDrvCheck.exe ()
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\Admin\Startmenü\Programme\Autostart\videologin.bat ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {389956FE-3A45-469C-B944-70308E06BAAC} hxxp://192.168.0.250/videocom.cab (CVServerObject Object)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1288345075375 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.10.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DE325503-6757-43AB-8E41-9704C37EF41D}: DhcpNameServer = 192.168.10.254
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.08.10 05:09:18 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009.12.01 10:53:00 | 000,670,072 | ---- | M] (Sysinternals - www.sysinternals.com) - Y:\autoruns.exe -- [ NTFS ]
O33 - MountPoints2\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\Shell\Auto\command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe e
O33 - MountPoints2\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\Shell\explore\Command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\Shell\open\Command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{2984f3b6-e54d-11dc-bb68-001bfc9e30a5}\Shell - "" = AutoRun
O33 - MountPoints2\{2984f3b6-e54d-11dc-bb68-001bfc9e30a5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{2984f3b6-e54d-11dc-bb68-001bfc9e30a5}\Shell\AutoRun\command - "" = E:\smartAP.exe
O33 - MountPoints2\{405676b3-96ce-11de-bcd6-001bfc9e3529}\Shell - "" = AutoRun
O33 - MountPoints2\{405676b3-96ce-11de-bcd6-001bfc9e3529}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{405676b3-96ce-11de-bcd6-001bfc9e3529}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{694d9527-e90c-11dc-bb6b-001bfc9e30a5}\Shell - "" = AutoRun
O33 - MountPoints2\{694d9527-e90c-11dc-bb6b-001bfc9e30a5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{694d9527-e90c-11dc-bb6b-001bfc9e30a5}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{832691c8-6584-11de-bc97-001bfc9e3529}\Shell\Auto\command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{832691c8-6584-11de-bc97-001bfc9e3529}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{832691c8-6584-11de-bc97-001bfc9e3529}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe e
O33 - MountPoints2\{832691c8-6584-11de-bc97-001bfc9e3529}\Shell\explore\Command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{832691c8-6584-11de-bc97-001bfc9e3529}\Shell\open\Command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\Shell\Auto\command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe e
O33 - MountPoints2\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\Shell\explore\Command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\Shell\open\Command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{e687634a-8953-11dd-bbe3-001bfc9e30a5}\Shell\AutoRun\command - "" = .\Encryption Tool\MaxtorEncryption.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789)
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EFCE7BE0-510E-4932-9475-F44CD90DE16A} - Microsoft .NET Framework 1.1 Security Update (KB2572067)
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivXNetworks, Inc.)
Drivers32: VIDC.DVSD - C:\WINDOWS\System32\pdvcodec.dll (Matsushita Electric Industrial Co., Ltd.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.MJPG - C:\Programme\Pinnacle\Shared Files\Filter\pvmjpg30.dll (Pegasus Imaging Corporation)
Drivers32: vidc.mp4e - C:\WINDOWS\System32\MPEG4Evfw.dll ()
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.12.07 13:48:48 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Admin\Desktop\OTL.exe
[2011.12.07 08:46:01 | 000,000,000 | ---D | C] -- C:\Programme\ESET
[2011.12.06 10:40:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Malwarebytes
[2011.12.06 10:40:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2011.12.05 10:40:13 | 000,101,720 | ---- | C] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2011.12.05 10:39:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lavasoft
[2011.12.05 10:37:08 | 000,028,552 | ---- | C] (Panda Security, S.L.) -- C:\WINDOWS\System32\drivers\pavboot.sys
[2011.12.05 10:36:10 | 000,000,000 | ---D | C] -- C:\Programme\Panda Security
[2011.12.05 10:33:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
[2011.12.05 10:33:14 | 000,000,000 | ---D | C] -- C:\Programme\Spybot - Search & Destroy 2
[2011.11.24 13:33:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Admin\Desktop\Thekla
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.12.07 13:48:51 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Admin\Desktop\OTL.exe
[2011.12.07 13:48:23 | 000,007,838 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\activexdebugger32.exe Virus entfernen - Trojaner-Board.URL
[2011.12.07 13:43:03 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011.12.07 13:43:01 | 000,001,084 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011.12.07 13:42:43 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011.12.07 13:41:00 | 000,391,330 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011.12.07 13:41:00 | 000,380,486 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011.12.07 13:41:00 | 000,063,778 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011.12.07 13:41:00 | 000,052,900 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011.12.07 13:33:00 | 000,001,088 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011.12.06 09:07:12 | 000,000,260 | ---- | M] () -- C:\WINDOWS\wininit.ini
[2011.12.05 10:45:22 | 000,000,448 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011.12.05 10:40:13 | 000,101,720 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2011.12.02 18:22:38 | 000,000,610 | ---- | M] () -- C:\WINDOWS\VFO.INI
[2011.12.02 17:29:52 | 000,091,136 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.12.02 15:24:25 | 000,000,089 | ---- | M] () -- C:\WINDOWS\ULead32.ini
[2011.12.02 15:24:01 | 000,000,349 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Dokumente\PCLECHAL.INI
[2011.12.01 19:12:06 | 000,000,264 | ---- | M] () -- C:\WINDOWS\tasks\shutdown 00_00.job
[2011.11.28 11:19:00 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2011.11.16 10:34:38 | 000,002,509 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Desktop\Microsoft Office Word 2003.lnk
[2011.11.09 18:19:55 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.12.05 16:04:53 | 000,007,838 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Desktop\activexdebugger32.exe Virus entfernen - Trojaner-Board.URL
[2011.12.05 11:01:02 | 000,000,260 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2011.12.05 10:40:22 | 000,000,448 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2010.12.08 08:42:31 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009.07.15 14:35:55 | 000,061,208 | ---- | C] () -- C:\WINDOWS\System32\MPEG4E-uninstall.exe
[2009.06.15 12:21:00 | 000,000,030 | -HS- | C] () -- C:\WINDOWS\System32\SECENEKLER8.INI
[2009.01.16 14:56:46 | 001,015,808 | ---- | C] () -- C:\WINDOWS\System32\MPEG4Evfw.dll
[2008.08.26 10:25:50 | 000,640,957 | ---- | C] () -- C:\WINDOWS\unins000.exe
[2008.08.26 10:25:50 | 000,000,804 | ---- | C] () -- C:\WINDOWS\unins000.dat
[2008.08.13 13:52:21 | 003,086,336 | ---- | C] () -- C:\WINDOWS\System32\NCMedia.dll
[2008.08.13 13:52:21 | 003,086,336 | ---- | C] () -- C:\WINDOWS\System32\flvvideo.dll
[2008.08.13 13:52:21 | 000,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008.08.13 13:52:21 | 000,383,238 | ---- | C] () -- C:\WINDOWS\System32\libmp3lame-0.dll
[2008.07.28 15:14:30 | 000,012,208 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2008.07.28 10:55:26 | 000,000,622 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008.06.23 08:37:50 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2008.03.03 10:55:24 | 000,000,000 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2008.01.30 09:59:53 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2008.01.11 13:58:56 | 000,091,136 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.01.11 13:57:55 | 000,000,028 | ---- | C] () -- C:\WINDOWS\MotionDVSTUDIO.INI
[2008.01.11 12:32:11 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2007.12.05 09:51:57 | 000,000,089 | ---- | C] () -- C:\WINDOWS\ULead32.ini
[2007.12.04 13:38:51 | 000,196,096 | ---- | C] () -- C:\WINDOWS\System32\macd32.dll
[2007.12.04 13:38:51 | 000,138,752 | ---- | C] () -- C:\WINDOWS\System32\mase32.dll
[2007.12.04 13:38:51 | 000,136,192 | ---- | C] () -- C:\WINDOWS\System32\mamc32.dll
[2007.12.04 13:38:51 | 000,057,856 | ---- | C] () -- C:\WINDOWS\System32\masd32.dll
[2007.12.04 13:38:51 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\ma32.dll
[2007.12.04 13:37:25 | 000,000,610 | ---- | C] () -- C:\WINDOWS\VFO.INI
[2007.12.04 13:35:36 | 000,194,248 | ---- | C] () -- C:\WINDOWS\System32\LTRFD13n.DLL
[2007.08.10 12:06:27 | 000,000,458 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2007.08.10 11:25:54 | 000,000,138 | ---- | C] () -- C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2007.08.10 05:58:53 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2007.08.10 05:57:54 | 000,139,336 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2007.08.10 05:25:16 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2007.08.10 05:14:12 | 000,026,365 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini
[2007.08.10 05:14:06 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2007.08.10 05:14:05 | 000,025,975 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2007.08.10 05:13:59 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2007.08.10 05:10:54 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2007.08.10 05:07:11 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2007.03.22 09:50:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2007.03.22 09:50:00 | 001,626,112 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2007.03.22 09:50:00 | 001,478,656 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2007.03.22 09:50:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2007.03.22 09:50:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2007.03.22 09:50:00 | 000,928,096 | ---- | C] () -- C:\WINDOWS\System32\nvucode.bin
[2007.03.22 09:50:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2007.03.22 09:50:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2007.03.22 09:50:00 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2007.03.22 09:50:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2005.07.29 19:38:24 | 003,375,104 | ---- | C] () -- C:\WINDOWS\System32\qt-mt331.dll
[2004.12.20 18:24:03 | 001,663,068 | ---- | C] () -- C:\WINDOWS\System32\libmmd.dll
[2004.08.04 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004.08.04 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004.08.04 13:00:00 | 000,391,330 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004.08.04 13:00:00 | 000,380,486 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004.08.04 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004.08.04 13:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004.08.04 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004.08.04 13:00:00 | 000,063,778 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004.08.04 13:00:00 | 000,052,900 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004.08.04 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004.08.04 13:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004.08.04 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004.08.04 13:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004.08.04 13:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004.08.04 13:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004.08.04 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004.03.11 01:26:10 | 000,406,016 | ---- | C] () -- C:\WINDOWS\System32\PSDrvCheck.exe
 
========== LOP Check ==========
 
[2008.08.06 11:12:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Audacity
[2008.07.28 15:14:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Blueberry
[2008.08.21 10:58:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\GelbeSeiten Deutschland
[2010.10.27 14:53:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\GetRightToGo
[2009.06.08 11:48:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\IrfanView
[2008.07.28 11:05:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\LogSys
[2008.06.04 08:20:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Nvu
[2008.08.21 10:58:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\TVG
[2008.07.28 11:03:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LogSys
[2008.01.11 12:15:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Panasonic
[2007.12.05 09:51:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pinnacle
[2009.09.24 12:44:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SmartSound Software Inc
[2009.07.15 14:33:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\VideoConverter
[2011.12.05 10:45:22 | 000,000,448 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2011.12.01 19:12:06 | 000,000,264 | ---- | M] () -- C:\WINDOWS\Tasks\shutdown 00_00.job
[2011.01.17 13:10:09 | 000,000,264 | ---- | M] () -- C:\WINDOWS\Tasks\shutdown 21_15.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2008.11.19 12:00:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Adobe
[2008.08.06 13:15:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Apple Computer
[2008.08.06 11:12:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Audacity
[2008.07.28 15:14:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Blueberry
[2008.08.21 10:58:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\GelbeSeiten Deutschland
[2010.10.27 14:53:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\GetRightToGo
[2011.06.29 11:10:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Google
[2008.05.30 08:05:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Help
[2007.08.10 05:13:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Identities
[2007.08.10 05:22:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\InstallShield
[2009.06.08 11:48:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\IrfanView
[2008.07.28 11:05:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\LogSys
[2008.01.18 13:29:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Macromedia
[2011.12.06 10:40:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Malwarebytes
[2010.06.15 11:02:53 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Microsoft
[2008.09.03 12:11:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mozilla
[2008.06.04 08:20:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Nvu
[2008.03.03 11:27:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Sun
[2008.08.21 10:58:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\TVG
[2010.03.23 12:46:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\U3
[2008.03.11 09:01:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\WinRAR
 
< %APPDATA%\*.exe /s >
[2009.07.09 16:57:42 | 001,878,984 | ---- | M] (Adobe Systems Incorporated) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
[2007.10.23 09:27:20 | 000,110,592 | ---- | M] () -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\U3\temp\cleanup.exe
[2008.05.02 10:41:48 | 003,493,888 | -H-- | M] (SanDisk Corporation) -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\U3\temp\Launchpad Removal.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2008.04.14 07:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008.04.14 07:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 23:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\agp440.sys
[2008.04.13 23:06:40 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.04.14 07:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008.04.14 07:03:54 | 020,108,202 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 23:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\atapi.sys
[2008.04.13 23:10:32 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.04 13:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2008.04.14 06:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\eventlog.dll
[2008.04.14 06:52:12 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll
[2004.08.04 13:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: IASTOR.SYS  >
[2007.03.21 11:58:56 | 000,304,920 | ---- | M] (Intel Corporation) MD5=997E8F5939F2D12CD9F2E6B395724C16 -- C:\Programme\Intel\Intel Matrix Storage Manager\Driver\IaStor.sys
[2007.03.21 13:58:56 | 000,304,920 | ---- | M] (Intel Corporation) MD5=997E8F5939F2D12CD9F2E6B395724C16 -- C:\WINDOWS\OemDir\iaStor.sys
[2007.03.21 11:58:56 | 000,304,920 | ---- | M] (Intel Corporation) MD5=997E8F5939F2D12CD9F2E6B395724C16 -- C:\WINDOWS\system32\drivers\iaStor.sys
[2007.03.21 13:58:56 | 000,304,920 | ---- | M] (Intel Corporation) MD5=997E8F5939F2D12CD9F2E6B395724C16 -- C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\iaStor.sys
[2007.03.21 11:59:30 | 000,381,720 | ---- | M] (Intel Corporation) MD5=9D7ED4275702E2FC409F2CC563245740 -- C:\Programme\Intel\Intel Matrix Storage Manager\Driver64\IaStor.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 06:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 03:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\netlogon.dll
[2008.04.14 06:52:20 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll
[2004.08.04 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
[2009.02.06 19:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB968389\SP2QFE\netlogon.dll
[2009.02.06 19:46:10 | 000,408,064 | ---- | M] (Microsoft Corporation) MD5=ED4BBAD725A21632FB205452749FC8F5 -- C:\WINDOWS\$hf_mig$\KB975467\SP2QFE\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2008.04.14 06:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 03:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\scecli.dll
[2008.04.14 06:52:24 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll
[2004.08.04 13:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
 
< MD5 for: USER32.DLL  >
[2007.03.08 16:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
[2005.03.02 19:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll
[2004.08.04 13:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll
[2007.03.08 16:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll
[2008.04.14 06:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 03:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\user32.dll
[2008.04.14 06:52:32 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.04.14 06:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\userinit.exe
[2008.04.14 06:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe
[2004.08.04 13:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004.08.04 13:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 06:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\SoftwareDistribution\Download\d7ca437757bb79190d8fe0f22734e38b\winlogon.exe
[2008.04.14 06:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.04 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004.08.04 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2007.08.10 06:56:43 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav
[2007.08.10 06:56:43 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav
[2007.08.10 06:56:43 | 000,458,752 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >
         

--- --- ---

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

:OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007.08.10 05:09:18 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2009.12.01 10:53:00 | 000,670,072 | ---- | M] (Sysinternals - www.sysinternals.com) - Y:\autoruns.exe -- [ NTFS ]
O33 - MountPoints2\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\Shell\Auto\command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe e
O33 - MountPoints2\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\Shell\explore\Command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\Shell\open\Command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{2984f3b6-e54d-11dc-bb68-001bfc9e30a5}\Shell - "" = AutoRun
O33 - MountPoints2\{2984f3b6-e54d-11dc-bb68-001bfc9e30a5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{2984f3b6-e54d-11dc-bb68-001bfc9e30a5}\Shell\AutoRun\command - "" = E:\smartAP.exe
O33 - MountPoints2\{405676b3-96ce-11de-bcd6-001bfc9e3529}\Shell - "" = AutoRun
O33 - MountPoints2\{405676b3-96ce-11de-bcd6-001bfc9e3529}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{405676b3-96ce-11de-bcd6-001bfc9e3529}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{694d9527-e90c-11dc-bb6b-001bfc9e30a5}\Shell - "" = AutoRun
O33 - MountPoints2\{694d9527-e90c-11dc-bb6b-001bfc9e30a5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{694d9527-e90c-11dc-bb6b-001bfc9e30a5}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{832691c8-6584-11de-bc97-001bfc9e3529}\Shell\Auto\command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{832691c8-6584-11de-bc97-001bfc9e3529}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{832691c8-6584-11de-bc97-001bfc9e3529}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe e
O33 - MountPoints2\{832691c8-6584-11de-bc97-001bfc9e3529}\Shell\explore\Command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{832691c8-6584-11de-bc97-001bfc9e3529}\Shell\open\Command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\Shell\Auto\command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe e
O33 - MountPoints2\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\Shell\explore\Command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\Shell\open\Command - "" = E:\activexdebugger32.exe f
O33 - MountPoints2\{e687634a-8953-11dd-bbe3-001bfc9e30a5}\Shell\AutoRun\command - "" = .\Encryption Tool\MaxtorEncryption.exe
[2011.12.01 19:12:06 | 000,000,264 | ---- | M] () -- C:\WINDOWS\tasks\shutdown 00_00.job
[2011.01.17 13:10:09 | 000,000,264 | ---- | M] () -- C:\WINDOWS\Tasks\shutdown 21_15.job
:Commands
[emptytemp]
[resethosts]
         

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
Y:\autoruns.exe moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\ not found.
File E:\activexdebugger32.exe f not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\ not found.
File C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe e not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\ not found.
File E:\activexdebugger32.exe f not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{07007ec2-6a3b-11de-bc9e-001bfc9e30a5}\ not found.
File E:\activexdebugger32.exe f not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2984f3b6-e54d-11dc-bb68-001bfc9e30a5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2984f3b6-e54d-11dc-bb68-001bfc9e30a5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2984f3b6-e54d-11dc-bb68-001bfc9e30a5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2984f3b6-e54d-11dc-bb68-001bfc9e30a5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2984f3b6-e54d-11dc-bb68-001bfc9e30a5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2984f3b6-e54d-11dc-bb68-001bfc9e30a5}\ not found.
File E:\smartAP.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{405676b3-96ce-11de-bcd6-001bfc9e3529}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{405676b3-96ce-11de-bcd6-001bfc9e3529}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{405676b3-96ce-11de-bcd6-001bfc9e3529}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{405676b3-96ce-11de-bcd6-001bfc9e3529}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{405676b3-96ce-11de-bcd6-001bfc9e3529}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{405676b3-96ce-11de-bcd6-001bfc9e3529}\ not found.
File E:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{694d9527-e90c-11dc-bb6b-001bfc9e30a5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{694d9527-e90c-11dc-bb6b-001bfc9e30a5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{694d9527-e90c-11dc-bb6b-001bfc9e30a5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{694d9527-e90c-11dc-bb6b-001bfc9e30a5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{694d9527-e90c-11dc-bb6b-001bfc9e30a5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{694d9527-e90c-11dc-bb6b-001bfc9e30a5}\ not found.
File E:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{832691c8-6584-11de-bc97-001bfc9e3529}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{832691c8-6584-11de-bc97-001bfc9e3529}\ not found.
File E:\activexdebugger32.exe f not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{832691c8-6584-11de-bc97-001bfc9e3529}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{832691c8-6584-11de-bc97-001bfc9e3529}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{832691c8-6584-11de-bc97-001bfc9e3529}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{832691c8-6584-11de-bc97-001bfc9e3529}\ not found.
File C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe e not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{832691c8-6584-11de-bc97-001bfc9e3529}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{832691c8-6584-11de-bc97-001bfc9e3529}\ not found.
File E:\activexdebugger32.exe f not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{832691c8-6584-11de-bc97-001bfc9e3529}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{832691c8-6584-11de-bc97-001bfc9e3529}\ not found.
File E:\activexdebugger32.exe f not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\ not found.
File E:\activexdebugger32.exe f not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\ not found.
File C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL activexdebugger32.exe e not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\ not found.
File E:\activexdebugger32.exe f not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a384e9ee-713f-11de-bcaa-001bfc9e30a5}\ not found.
File E:\activexdebugger32.exe f not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e687634a-8953-11dd-bbe3-001bfc9e30a5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e687634a-8953-11dd-bbe3-001bfc9e30a5}\ not found.
File .\Encryption Tool\MaxtorEncryption.exe not found.
C:\WINDOWS\tasks\shutdown 00_00.job moved successfully.
C:\WINDOWS\Tasks\shutdown 21_15.job moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Admin
->Temp folder emptied: 13315528 bytes
->Temporary Internet Files folder emptied: 10506514 bytes
->Java cache emptied: 52442107 bytes
->FireFox cache emptied: 59652009 bytes
->Flash cache emptied: 1993888 bytes

User: Administrator
->Temp folder emptied: 587193 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 335565017 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 732500 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2660939 bytes
%systemroot%\System32 .tmp files removed: 2833287 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 17047 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 458,00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.31.0 log created on 12072011_144604

Files\Folders moved on Reboot...
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temporary Internet Files\Content.IE5\GNRBL4LK\ads[1].htm moved successfully.
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temporary Internet Files\Content.IE5\GNRBL4LK\cm[1].htm moved successfully.
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temporary Internet Files\Content.IE5\2Q89KYAG\105824-activexdebugger32-exe-virus-entfernen[1].htm moved successfully.
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temporary Internet Files\Content.IE5\2Q89KYAG\ads[1].htm moved successfully.
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temporary Internet Files\Content.IE5\2Q89KYAG\ads[2].htm moved successfully.
C:\Dokumente und Einstellungen\Admin\Lokale Einstellungen\Temporary Internet Files\AntiPhishing\A0AB7674-8D67-4F4D-B5E1-96FAEADFB79D.dat moved successfully.
File move failed. C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Temp\nvcbin.def.3384211d.tmp scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Bitte nun (im normalen Modus!) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!




Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen!

So nun der Log von TDSS

08:28:54.0578 2688 TDSS rootkit removing tool 2.6.22.0 Dec 7 2011 13:21:06
08:28:54.0953 2688 ============================================================
08:28:54.0953 2688 Current date / time: 2011/12/08 08:28:54.0953
08:28:54.0953 2688 SystemInfo:
08:28:54.0953 2688
08:28:54.0953 2688 OS Version: 5.1.2600 ServicePack: 3.0
08:28:54.0953 2688 Product type: Workstation
08:28:54.0953 2688 ComputerName: SCHNITT2
08:28:54.0953 2688 UserName: Admin
08:28:54.0953 2688 Windows directory: C:\WINDOWS
08:28:54.0953 2688 System windows directory: C:\WINDOWS
08:28:54.0953 2688 Processor architecture: Intel x86
08:28:54.0953 2688 Number of processors: 2
08:28:54.0953 2688 Page size: 0x1000
08:28:54.0953 2688 Boot type: Normal boot
08:28:54.0953 2688 ============================================================
08:28:55.0515 2688 Initialize success
08:29:31.0671 3660 ============================================================
08:29:31.0671 3660 Scan started
08:29:31.0671 3660 Mode: Manual; SigCheck; TDLFS;
08:29:31.0671 3660 ============================================================
08:29:31.0796 3660 61883 (914a9709fc3bf419ad2f85547f2a4832) C:\WINDOWS\system32\DRIVERS\61883.sys
08:29:34.0078 3660 61883 - ok
08:29:34.0140 3660 Abiosdsk - ok
08:29:34.0187 3660 abp480n5 - ok
08:29:34.0234 3660 ACPI (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
08:29:34.0421 3660 ACPI - ok
08:29:34.0468 3660 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
08:29:34.0578 3660 ACPIEC - ok
08:29:34.0578 3660 adpu160m - ok
08:29:34.0625 3660 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
08:29:34.0734 3660 aec - ok
08:29:34.0781 3660 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
08:29:34.0875 3660 AFD - ok
08:29:34.0875 3660 Aha154x - ok
08:29:34.0890 3660 aic78u2 - ok
08:29:34.0890 3660 aic78xx - ok
08:29:34.0906 3660 AliIde - ok
08:29:34.0906 3660 amsint - ok
08:29:34.0953 3660 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
08:29:35.0078 3660 Arp1394 - ok
08:29:35.0125 3660 ASAPIW2K (875f9079cabee679d34b49e466b61701) C:\WINDOWS\system32\Drivers\ASAPIW2K.sys
08:29:35.0156 3660 ASAPIW2K ( UnsignedFile.Multi.Generic ) - warning
08:29:35.0156 3660 ASAPIW2K - detected UnsignedFile.Multi.Generic (1)
08:29:35.0156 3660 asc - ok
08:29:35.0171 3660 asc3350p - ok
08:29:35.0171 3660 asc3550 - ok
08:29:35.0171 3660 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
08:29:35.0265 3660 AsyncMac - ok
08:29:35.0281 3660 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
08:29:35.0390 3660 atapi - ok
08:29:35.0406 3660 Atdisk - ok
08:29:35.0437 3660 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
08:29:35.0546 3660 Atmarpc - ok
08:29:35.0578 3660 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
08:29:35.0671 3660 audstub - ok
08:29:35.0703 3660 Avc (f8e6956a614f15a0860474c5e2a7de6b) C:\WINDOWS\system32\DRIVERS\avc.sys
08:29:35.0796 3660 Avc - ok
08:29:35.0812 3660 bbcap (709fbe6eced1c3259d2b50bb0520b765) C:\WINDOWS\system32\DRIVERS\bbcap.sys
08:29:35.0859 3660 bbcap - ok
08:29:35.0890 3660 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
08:29:35.0984 3660 Beep - ok
08:29:36.0093 3660 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
08:29:36.0187 3660 cbidf2k - ok
08:29:36.0203 3660 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
08:29:36.0296 3660 CCDECODE - ok
08:29:36.0296 3660 cd20xrnt - ok
08:29:36.0421 3660 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
08:29:36.0531 3660 Cdaudio - ok
08:29:36.0703 3660 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
08:29:36.0796 3660 Cdfs - ok
08:29:36.0828 3660 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
08:29:36.0937 3660 Cdrom - ok
08:29:36.0937 3660 Changer - ok
08:29:36.0953 3660 CmdIde - ok
08:29:36.0953 3660 Cpqarray - ok
08:29:36.0968 3660 dac2w2k - ok
08:29:36.0968 3660 dac960nt - ok
08:29:36.0968 3660 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
08:29:37.0062 3660 Disk - ok
08:29:37.0109 3660 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
08:29:37.0250 3660 dmboot - ok
08:29:37.0250 3660 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
08:29:37.0359 3660 dmio - ok
08:29:37.0375 3660 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
08:29:37.0453 3660 dmload - ok
08:29:37.0468 3660 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
08:29:37.0578 3660 DMusic - ok
08:29:37.0703 3660 dpti2o - ok
08:29:37.0718 3660 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
08:29:37.0812 3660 drmkaud - ok
08:29:37.0984 3660 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
08:29:38.0062 3660 Fastfat - ok
08:29:38.0171 3660 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
08:29:38.0250 3660 Fdc - ok
08:29:38.0359 3660 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
08:29:38.0453 3660 Fips - ok
08:29:38.0468 3660 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
08:29:38.0562 3660 Flpydisk - ok
08:29:38.0718 3660 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
08:29:38.0828 3660 FltMgr - ok
08:29:38.0843 3660 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
08:29:38.0921 3660 Fs_Rec - ok
08:29:38.0921 3660 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
08:29:39.0015 3660 Ftdisk - ok
08:29:39.0015 3660 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
08:29:39.0125 3660 Gpc - ok
08:29:39.0156 3660 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
08:29:39.0265 3660 HDAudBus - ok
08:29:39.0281 3660 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
08:29:39.0375 3660 hidusb - ok
08:29:39.0375 3660 hpn - ok
08:29:39.0421 3660 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
08:29:39.0734 3660 HTTP - ok
08:29:39.0859 3660 i2omgmt - ok
08:29:39.0875 3660 i2omp - ok
08:29:39.0890 3660 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
08:29:39.0968 3660 i8042prt - ok
08:29:40.0000 3660 iaStor (997e8f5939f2d12cd9f2e6b395724c16) C:\WINDOWS\system32\drivers\iaStor.sys
08:29:40.0046 3660 iaStor - ok
08:29:40.0046 3660 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
08:29:40.0140 3660 Imapi - ok
08:29:40.0140 3660 ini910u - ok
08:29:40.0234 3660 IntcAzAudAddService (e37589414437a60797e94c0f57c546db) C:\WINDOWS\system32\drivers\RtkHDAud.sys
08:29:40.0531 3660 IntcAzAudAddService - ok
08:29:40.0546 3660 IntelIde - ok
08:29:40.0593 3660 intelppm (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
08:29:40.0687 3660 intelppm - ok
08:29:40.0703 3660 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
08:29:40.0812 3660 Ip6Fw - ok
08:29:40.0843 3660 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
08:29:40.0953 3660 IpFilterDriver - ok
08:29:40.0968 3660 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
08:29:41.0062 3660 IpInIp - ok
08:29:41.0062 3660 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
08:29:41.0171 3660 IpNat - ok
08:29:41.0187 3660 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
08:29:41.0312 3660 IPSec - ok
08:29:41.0328 3660 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
08:29:41.0421 3660 IRENUM - ok
08:29:41.0453 3660 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
08:29:41.0531 3660 isapnp - ok
08:29:41.0546 3660 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
08:29:41.0625 3660 Kbdclass - ok
08:29:41.0640 3660 kbdhid (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
08:29:41.0734 3660 kbdhid - ok
08:29:41.0750 3660 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
08:29:41.0875 3660 kmixer - ok
08:29:41.0921 3660 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
08:29:42.0031 3660 KSecDD - ok
08:29:42.0031 3660 lbrtfdc - ok
08:29:42.0046 3660 MBAMSwissArmy - ok
08:29:42.0062 3660 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
08:29:42.0156 3660 mnmdd - ok
08:29:42.0171 3660 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
08:29:42.0250 3660 Modem - ok
08:29:42.0265 3660 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
08:29:42.0359 3660 Mouclass - ok
08:29:42.0375 3660 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
08:29:42.0468 3660 mouhid - ok
08:29:42.0484 3660 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
08:29:42.0578 3660 MountMgr - ok
08:29:42.0578 3660 mraid35x - ok
08:29:42.0593 3660 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
08:29:42.0687 3660 MRxDAV - ok
08:29:42.0750 3660 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
08:29:42.0890 3660 MRxSmb - ok
08:29:42.0906 3660 MSDV (1477849772712bac69c144dcf2c9ce81) C:\WINDOWS\system32\DRIVERS\msdv.sys
08:29:43.0015 3660 MSDV - ok
08:29:43.0015 3660 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
08:29:43.0109 3660 Msfs - ok
08:29:43.0171 3660 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
08:29:43.0250 3660 MSKSSRV - ok
08:29:43.0265 3660 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
08:29:43.0343 3660 MSPCLOCK - ok
08:29:43.0359 3660 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
08:29:43.0437 3660 MSPQM - ok
08:29:43.0484 3660 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
08:29:43.0562 3660 mssmbios - ok
08:29:43.0609 3660 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
08:29:43.0703 3660 MSTEE - ok
08:29:43.0734 3660 MTsensor (d48659bb24c48345d926ecb45c1ebdf5) C:\WINDOWS\system32\DRIVERS\ASACPI.sys
08:29:43.0796 3660 MTsensor - ok
08:29:43.0812 3660 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
08:29:43.0859 3660 Mup - ok
08:29:43.0890 3660 mv61xx (702f8cd6dee366f9d795761f8325b4f8) C:\WINDOWS\system32\DRIVERS\mv61xx.sys
08:29:43.0984 3660 mv61xx - ok
08:29:44.0000 3660 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
08:29:44.0109 3660 NABTSFEC - ok
08:29:44.0125 3660 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
08:29:44.0234 3660 NDIS - ok
08:29:44.0250 3660 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
08:29:44.0343 3660 NdisIP - ok
08:29:44.0453 3660 Ndiskio (0bc1739dc0553548b7920acd8b61389d) C:\NORMAN\Nse\bin\NDISKIO.SYS
08:29:44.0484 3660 Ndiskio - ok
08:29:44.0515 3660 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
08:29:44.0562 3660 NdisTapi - ok
08:29:44.0609 3660 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
08:29:44.0703 3660 Ndisuio - ok
08:29:44.0750 3660 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
08:29:44.0875 3660 NdisWan - ok
08:29:44.0890 3660 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
08:29:44.0968 3660 NDProxy - ok
08:29:45.0000 3660 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
08:29:45.0093 3660 NetBIOS - ok
08:29:45.0125 3660 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
08:29:45.0250 3660 NetBT - ok
08:29:45.0312 3660 NGS (9d34a4697d035cf829d869831bab4958) c:\norman\nvc\bin\ngs.sys
08:29:45.0343 3660 NGS - ok
08:29:45.0359 3660 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
08:29:45.0453 3660 NIC1394 - ok
08:29:45.0468 3660 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
08:29:45.0546 3660 Npfs - ok
08:29:45.0578 3660 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
08:29:45.0703 3660 Ntfs - ok
08:29:45.0734 3660 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
08:29:45.0828 3660 Null - ok
08:29:45.0953 3660 nv (c190757a29a9bc0199032f353dd2557a) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
08:29:46.0546 3660 nv - ok
08:29:46.0625 3660 NvcMFlt (ca7d649203aa8472bbdb07ee1f9c7612) C:\WINDOWS\system32\DRIVERS\nvcw32mf.sys
08:29:46.0640 3660 NvcMFlt - ok
08:29:46.0703 3660 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
08:29:46.0796 3660 NwlnkFlt - ok
08:29:46.0828 3660 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
08:29:46.0906 3660 NwlnkFwd - ok
08:29:46.0953 3660 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
08:29:47.0078 3660 ohci1394 - ok
08:29:47.0093 3660 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
08:29:47.0218 3660 Parport - ok
08:29:47.0234 3660 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
08:29:47.0328 3660 PartMgr - ok
08:29:47.0359 3660 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
08:29:47.0437 3660 ParVdm - ok
08:29:47.0468 3660 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
08:29:47.0562 3660 PCI - ok
08:29:47.0578 3660 PCIDump - ok
08:29:47.0593 3660 PCIIde (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
08:29:47.0687 3660 PCIIde - ok
08:29:47.0734 3660 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
08:29:47.0843 3660 Pcmcia - ok
08:29:47.0843 3660 PDCOMP - ok
08:29:47.0843 3660 PDFRAME - ok
08:29:47.0859 3660 PDRELI - ok
08:29:47.0859 3660 PDRFRAME - ok
08:29:47.0875 3660 perc2 - ok
08:29:47.0875 3660 perc2hib - ok
08:29:47.0906 3660 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
08:29:48.0015 3660 PptpMiniport - ok
08:29:48.0031 3660 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
08:29:48.0156 3660 PSched - ok
08:29:48.0187 3660 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
08:29:48.0281 3660 Ptilink - ok
08:29:48.0281 3660 ql1080 - ok
08:29:48.0296 3660 Ql10wnt - ok
08:29:48.0296 3660 ql12160 - ok
08:29:48.0296 3660 ql1240 - ok
08:29:48.0312 3660 ql1280 - ok
08:29:48.0328 3660 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
08:29:48.0406 3660 RasAcd - ok
08:29:48.0421 3660 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
08:29:48.0531 3660 Rasl2tp - ok
08:29:48.0546 3660 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
08:29:48.0640 3660 RasPppoe - ok
08:29:48.0640 3660 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
08:29:48.0734 3660 Raspti - ok
08:29:48.0765 3660 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
08:29:48.0859 3660 Rdbss - ok
08:29:48.0859 3660 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
08:29:48.0937 3660 RDPCDD - ok
08:29:48.0968 3660 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
08:29:49.0093 3660 rdpdr - ok
08:29:49.0156 3660 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
08:29:49.0250 3660 RDPWD - ok
08:29:49.0296 3660 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
08:29:49.0390 3660 redbook - ok
08:29:49.0437 3660 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
08:29:49.0531 3660 Secdrv - ok
08:29:49.0562 3660 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
08:29:49.0656 3660 serenum - ok
08:29:49.0671 3660 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
08:29:49.0781 3660 Serial - ok
08:29:49.0781 3660 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
08:29:49.0875 3660 Sfloppy - ok
08:29:49.0875 3660 Simbad - ok
08:29:49.0906 3660 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
08:29:50.0000 3660 SLIP - ok
08:29:50.0000 3660 Sparrow - ok
08:29:50.0031 3660 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
08:29:50.0125 3660 splitter - ok
08:29:50.0140 3660 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
08:29:50.0250 3660 sr - ok
08:29:50.0312 3660 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
08:29:50.0625 3660 Srv - ok
08:29:50.0656 3660 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
08:29:50.0750 3660 streamip - ok
08:29:50.0750 3660 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
08:29:50.0828 3660 swenum - ok
08:29:50.0953 3660 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
08:29:51.0062 3660 swmidi - ok
08:29:51.0171 3660 symc810 - ok
08:29:51.0187 3660 symc8xx - ok
08:29:51.0187 3660 sym_hi - ok
08:29:51.0203 3660 sym_u3 - ok
08:29:51.0218 3660 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
08:29:51.0312 3660 sysaudio - ok
08:29:51.0375 3660 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
08:29:51.0718 3660 Tcpip - ok
08:29:51.0734 3660 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
08:29:51.0828 3660 TDPIPE - ok
08:29:51.0859 3660 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
08:29:51.0953 3660 TDTCP - ok
08:29:52.0062 3660 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
08:29:52.0171 3660 TermDD - ok
08:29:52.0187 3660 TosIde - ok
08:29:52.0218 3660 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
08:29:52.0296 3660 Udfs - ok
08:29:52.0312 3660 ultra - ok
08:29:52.0375 3660 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
08:29:52.0484 3660 Update - ok
08:29:52.0531 3660 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
08:29:52.0640 3660 usbaudio - ok
08:29:52.0734 3660 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
08:29:53.0062 3660 usbccgp - ok
08:29:53.0062 3660 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
08:29:53.0171 3660 usbehci - ok
08:29:53.0187 3660 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
08:29:53.0296 3660 usbhub - ok
08:29:53.0328 3660 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
08:29:53.0421 3660 USBSTOR - ok
08:29:53.0546 3660 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
08:29:53.0640 3660 usbuhci - ok
08:29:53.0750 3660 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
08:29:53.0937 3660 usbvideo - ok
08:29:54.0078 3660 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
08:29:54.0171 3660 VgaSave - ok
08:29:54.0171 3660 ViaIde - ok
08:29:54.0203 3660 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
08:29:54.0281 3660 VolSnap - ok
08:29:54.0312 3660 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
08:29:54.0390 3660 Wanarp - ok
08:29:54.0406 3660 WDICA - ok
08:29:54.0437 3660 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
08:29:54.0531 3660 wdmaud - ok
08:29:54.0578 3660 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
08:29:54.0671 3660 WSTCODEC - ok
08:29:54.0734 3660 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
08:29:54.0796 3660 WudfPf - ok
08:29:54.0828 3660 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
08:29:54.0875 3660 WudfRd - ok
08:29:54.0937 3660 yukonwxp (a5d4eae27e68625296d685a786897491) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
08:29:54.0968 3660 yukonwxp - ok
08:29:55.0000 3660 MBR (0x1B8) (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
08:29:55.0281 3660 \Device\Harddisk0\DR0 - ok
08:29:55.0281 3660 Boot (0x1200) (46cbb2f5f7e40286bac296b2ef81a5dc) \Device\Harddisk0\DR0\Partition0
08:29:55.0281 3660 \Device\Harddisk0\DR0\Partition0 - ok
08:29:55.0281 3660 ============================================================
08:29:55.0281 3660 Scan finished
08:29:55.0281 3660 ============================================================
08:29:55.0390 3648 Detected object count: 1
08:29:55.0390 3648 Actual detected object count: 1
08:30:06.0484 3648 ASAPIW2K ( UnsignedFile.Multi.Generic ) - skipped by user
08:30:06.0484 3648 ASAPIW2K ( UnsignedFile.Multi.Generic ) - User select action: Skip

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

• Lade dir ComboFix hier herunter auf deinen Desktop.

• Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

• Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
  Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

• Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.