Hallo,

ich habe ein Problem. Seit kurzem kann ich keine vernünftige Google-Recherche machen. Sobald ich einen Suchbegriff eingebe, erscheinen zwar die Treffer. Aber sobald ich auf einen Treffer klicke, dann gelange ich nicht zu ihm, sondern werde umgeleitet auf Werbeseiten. Immer wieder taucht dabei rocketnews auf. Was soll ich tun? Wäre sehr dankbar, wenn mir jemand helfen könnte.

Schöne Grüße

MauriM

Hi,

wahrscheinlich TDSS (Rootkit, das Google/Internet "umbiegt")...

OTL
Lade Dir OTL von Oldtimer herunter (http://filepony.de/download-otl/) und speichere es auf Deinem Desktop

• Doppelklick auf die OTL.exe

• Vista/Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen

• Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output

• Unter Extra Registry, wähle bitte Use SafeList

• Klicke nun auf Run Scan links oben

• Wenn der Scan beendet wurde werden 2 Logfiles erstellt (OTL.TXT und EXTRAS.TXT)

• Poste die Logfiles hier in den Thread

• Zusätzlich folgendes Programm runterladen LanmanCheck ausführen und Ausgabe abkopieren und posten

TDSS-Killer
Download und Anweisung unter: Wie werden Schadprogramme der Familie Rootkit.Win32.TDSS bekämpft?
Entpacke alle Dateien in einem eigenen Verzeichnis (z. B: C:\TDSS)!
Aufruf über den Explorer duch Doppelklick auf die TDSSKiller.exe.
Stelle den Killer wir folgt ein:

Dann den Scan starten durch (Start Scan).
Wenn der Scan fertig ist bitte "Report" anwählen (eventuelle Funde erstmal mit Skip übergehen). Es öffnet sich ein Fenster, den Text abkopieren und hier posten...

chris

Hallo Chris,

wow, das ging ja schnell. Vielen Dank.

hier kommen die Logfiles.

Otl:OTL Logfile:

OTL logfile created on: 21.06.2012 14:26:15 - Run 1
OTL by OldTimer - Version 3.2.50.0     Folder = C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
511,49 Mb Total Physical Memory | 189,57 Mb Available Physical Memory | 37,06% Memory free
1,22 Gb Paging File | 0,62 Gb Available in Paging File | 51,12% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 29,30 Gb Total Space | 11,26 Gb Free Space | 38,43% Space Free | Partition Type: NTFS
Drive D: | 47,03 Gb Total Space | 41,74 Gb Free Space | 88,76% Space Free | Partition Type: NTFS
 
Computer Name: MUCH-2LMT4R27G4 | User Name: Much | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Programme\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - C:\Programme\Java\jre6\bin\jp2native.dll ()
MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU ()
MOD - C:\WINDOWS\system32\redmonnt.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found
SRV - (AppMgmt) -- %SystemRoot%\System32\appmgmts.dll File not found
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (AntiVirScheduler) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WDICA) --  File not found
DRV - (PDRFRAME) --  File not found
DRV - (PDRELI) --  File not found
DRV - (PDFRAME) --  File not found
DRV - (PDCOMP) --  File not found
DRV - (PCIDump) --  File not found
DRV - (MpKsl37b649c1) -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{6B8382E0-02A9-4E14-8C6B-CA6772B89399}\MpKsl37b649c1.sys File not found
DRV - (lbrtfdc) --  File not found
DRV - (i2omgmt) --  File not found
DRV - (Changer) --  File not found
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\WINDOWS\system32\drivers\avkmgr.sys (Avira GmbH)
DRV - (MBAMProtector) -- C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (VIAudio) VIA AC'97 Audiocontroller (WDM) -- C:\WINDOWS\system32\drivers\ac97via.sys (VIA Technologies, Inc.)
DRV - (NtApm) -- C:\WINDOWS\system32\drivers\NtApm.sys (Microsoft Corporation)
DRV - (FA312) -- C:\WINDOWS\system32\drivers\FA312nd5.sys (NETGEAR Corp.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_257.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.06.18 13:55:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.13 10:16:33 | 000,000,000 | ---D | M]
 
[2010.05.03 13:03:11 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Mozilla\Extensions
[2012.05.02 09:31:35 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Mozilla\Firefox\Profiles\vddbd5sr.default\extensions
[2011.11.22 11:56:14 | 000,000,000 | ---D | M] (20-20 3D Viewer - IKEA) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Mozilla\Firefox\Profiles\vddbd5sr.default\extensions\2020Player_IKEA@2020Technologies.com
[2011.12.19 13:18:12 | 000,000,933 | ---- | M] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Mozilla\Firefox\Profiles\vddbd5sr.default\searchplugins\11-suche.xml
[2011.12.19 13:18:12 | 000,002,419 | ---- | M] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Mozilla\Firefox\Profiles\vddbd5sr.default\searchplugins\englische-ergebnisse.xml
[2011.12.19 13:18:12 | 000,010,525 | ---- | M] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Mozilla\Firefox\Profiles\vddbd5sr.default\searchplugins\gmx-suche.xml
[2011.12.19 13:18:12 | 000,002,457 | ---- | M] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Mozilla\Firefox\Profiles\vddbd5sr.default\searchplugins\lastminute.xml
[2011.12.19 13:18:12 | 000,005,508 | ---- | M] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Mozilla\Firefox\Profiles\vddbd5sr.default\searchplugins\webde-suche.xml
[2012.06.06 18:12:38 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.04.17 12:53:29 | 000,576,958 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\MUCH.MUCH-2LMT4R27G4\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\VDDBD5SR.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI
[2012.06.18 13:55:39 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.03.07 15:50:47 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2012.06.01 18:33:00 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.01 18:33:00 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.06.01 18:33:00 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.01 18:33:00 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.01 18:33:00 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.01 18:33:00 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2001.08.23 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [api32] C:\DOKUME~1\MUCH~1.MUC\LOKALE~1\Temp\apiqq.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} https://sphinx.zdf.de/sphinx3/smsx.cab (MeadCo ScriptX)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272889079111 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1272889161649 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {F5131C24-E56D-11CF-B78A-444553540000} https://sphinx.zdf.de/sphinx3/zdfmenu.cab (Ikonic Menu Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.109.123.196 213.191.74.18 213.191.92.86 62.109.123.7
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A5BB5F0E-1522-4595-A25E-D634154E6B57}: DhcpNameServer = 62.109.123.196 213.191.74.18 213.191.92.86 62.109.123.7
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.04.13 11:26:07 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.21 12:58:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution
[2012.06.21 12:57:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood
[2012.06.20 18:27:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Malwarebytes
[2012.06.20 18:27:51 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Startmenü\Programme\Malwarebytes' Anti-Malware
[2012.06.20 18:27:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Malwarebytes
[2012.06.20 18:27:47 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012.06.20 18:27:47 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2012.06.20 18:26:43 | 010,063,000 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\mbam-setup-1.61.0.1400.exe
[2012.06.20 18:18:17 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.06.20 18:15:05 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\OTL.exe
[2012.06.14 10:54:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Eigene Dateien\ADAC
[2012.06.14 09:44:31 | 000,521,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsdbgui.dll
[2011.03.29 11:08:31 | 012,420,392 | ---- | C] (Mozilla) -- C:\Programme\Firefox Setup 4.0.exe
[2011.03.29 10:28:23 | 012,721,056 | ---- | C] (Mozilla) -- C:\Programme\GMX_MFF4_Setup.exe
[2011.01.18 18:12:43 | 038,808,920 | ---- | C] (Microsoft Corporation) -- C:\Programme\FileFormatConverters.exe
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.21 14:45:49 | 000,619,957 | ---- | M] (No company) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\LanmanCheck.exe
[2012.06.21 14:39:01 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.06.21 12:55:43 | 000,013,002 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.06.21 12:55:06 | 000,000,310 | ---- | M] () -- C:\WINDOWS\tasks\EJJM.job
[2012.06.21 12:55:02 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.06.20 18:26:52 | 010,063,000 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\mbam-setup-1.61.0.1400.exe
[2012.06.20 18:15:06 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\OTL.exe
[2012.06.20 16:49:55 | 000,215,836 | ---- | M] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\Cuneo_map.png
[2012.06.14 10:13:24 | 000,130,096 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.06.14 10:05:10 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.06.14 09:42:16 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012.06.14 09:42:15 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012.06.06 18:12:47 | 000,000,696 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Desktop\Mozilla Firefox.lnk
[2012.06.05 18:23:10 | 000,252,260 | ---- | M] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\EM_Spielplan.pdf
[2012.06.02 15:19:38 | 000,329,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wucltui.dll
[2012.06.02 15:19:38 | 000,329,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wucltui.dll
[2012.06.02 15:19:38 | 000,219,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuaucpl.cpl
[2012.06.02 15:19:38 | 000,210,968 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuweb.dll
[2012.06.02 15:19:38 | 000,015,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wuapi.dll.mui
[2012.06.02 15:19:34 | 000,097,304 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cdm.dll
[2012.06.02 15:19:34 | 000,097,304 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\cdm.dll
[2012.06.02 15:19:34 | 000,053,784 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuauclt.exe
[2012.06.02 15:19:28 | 000,023,576 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wucltui.dll.mui
[2012.06.02 15:19:24 | 000,577,048 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wuapi.dll
[2012.06.02 15:19:24 | 000,577,048 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuapi.dll
[2012.06.02 15:19:18 | 001,933,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuaueng.dll
[2012.06.02 15:18:58 | 000,275,696 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll
[2012.06.02 15:18:58 | 000,018,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll.mui
[2012.05.31 15:22:01 | 000,604,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\crypt32.dll
[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.20 16:49:42 | 000,215,836 | ---- | C] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\Cuneo_map.png
[2012.06.05 18:23:10 | 000,252,260 | ---- | C] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\EM_Spielplan.pdf
[2012.04.24 15:02:40 | 000,139,264 | RHS- | C] () -- C:\WINDOWS\System32\netrap0.dll
[2012.02.15 11:10:58 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.02.22 16:27:04 | 000,003,584 | ---- | C] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

< End of report >
         

--- --- ---

Extras.TxtOTL Logfile:

OTL Extras logfile created on: 21.06.2012 14:26:15 - Run 1
OTL by OldTimer - Version 3.2.50.0     Folder = C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
511,49 Mb Total Physical Memory | 189,57 Mb Available Physical Memory | 37,06% Memory free
1,22 Gb Paging File | 0,62 Gb Available in Paging File | 51,12% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 29,30 Gb Total Space | 11,26 Gb Free Space | 38,43% Space Free | Partition Type: NTFS
Drive D: | 47,03 Gb Total Space | 41,74 Gb Free Space | 88,76% Space Free | Partition Type: NTFS
 
Computer Name: MUCH-2LMT4R27G4 | User Name: Much | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:TCP" = 1900:TCP:LocalSubNet:Enabled:UDP 1900
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\Temp\NavBrowser.exe" = C:\WINDOWS\Temp\NavBrowser.exe:*:Enabled:NAVBrowser -- (Naviant, Inc.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E0131B2-CF18-40D9-A331-60A3746C1204}" = EPSON Scan
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6C11D561-620B-47DA-A693-4C597F3CDF40}" = EPSON Smart Panel
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{913D0407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Standard für Schüler, Studierende und Lehrkräfte
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DBEA589-5202-4504-90AE-97A73F139FE4}" = EPSON Photo Print
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.1 - Deutsch
"{B69CC1A5-0404-11D6-ABCB-005004C21D30}" = EPSON Copy Utility
"{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}" = ScanToWeb
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"Digital Editions" = Adobe Digital Editions
"FreePDF_XP" = FreePDF (Remove only)
"GPL Ghostscript 8.71" = GPL Ghostscript 8.71
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"P2400P Reference Guide" = P2400P Reference Guide
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 10.03.2011 11:01:11 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung WINWORD.EXE, Version 10.0.6866.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 14.03.2011 05:18:21 | Computer Name = MUCH-2LMT4R27G4 | Source = MPSampleSubmission | ID = 5000
Description = 
 
Error - 15.03.2011 05:26:41 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 1.9.2.4079, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 16.03.2011 05:17:10 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 1.9.2.4079, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 16.03.2011 05:17:21 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.4079,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x0000100b.
 
Error - 11.04.2011 05:28:21 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung WINWORD.EXE, Version 10.0.6866.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 11.04.2011 05:30:55 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung WINWORD.EXE, Version 10.0.6866.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 11.04.2011 05:30:58 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Hang | ID = 1001
Description = Fehlerhafter Speicherbereich 2058850643.
 
Error - 13.04.2011 06:14:32 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 2.0.0.4094, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 13.04.2011 06:14:41 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Hang | ID = 1001
Description = Fehlerhafter Speicherbereich -1935456019.
 
[ System Events ]
Error - 13.06.2012 10:51:22 | Computer Name = MUCH-2LMT4R27G4 | Source = Print | ID = 6161
Description = Das Dokument Microsoft Word - Lebenslauf.doc, im Besitz von Much, 
konnte nicht auf dem Drucker HP DeskJet 1220C gedruckt werden. Datentyp: NT EMF 
1.008. Größe der Warteschlangendatei in Bytes: 2818048. Anzahl der gedruckten Bytes:
 0. Gesamtanzahl der Seiten des Dokuments: 3. Anzahl der gedruckten Seiten: 0. Clientcomputer:
 \\MUCH-2LMT4R27G4. Vom Druckprozessor zurückgelieferter Win32-Fehlercode: 2250 
(0x8ca). 
 
Error - 14.06.2012 03:41:24 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   i8042prt
 
Error - 14.06.2012 04:15:03 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   i8042prt
 
Error - 15.06.2012 04:47:38 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   i8042prt
 
Error - 18.06.2012 03:35:06 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   i8042prt
 
Error - 20.06.2012 04:08:37 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   i8042prt
 
Error - 20.06.2012 06:23:42 | Computer Name = MUCH-2LMT4R27G4 | Source = Print | ID = 6161
Description = Das Dokument Gutschrift Ahnen.pdf, im Besitz von Much, konnte nicht
 auf dem Drucker HP DeskJet 1220C gedruckt werden. Datentyp: NT EMF 1.008. Größe
 der Warteschlangendatei in Bytes: 463036. Anzahl der gedruckten Bytes: 0. Gesamtanzahl
 der Seiten des Dokuments: 1. Anzahl der gedruckten Seiten: 0. Clientcomputer: \\MUCH-2LMT4R27G4.
 Vom Druckprozessor zurückgelieferter Win32-Fehlercode: 2250 (0x8ca). 
 
Error - 20.06.2012 12:18:22 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7034
Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 20.06.2012 12:23:56 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   i8042prt
 
Error - 21.06.2012 06:56:41 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   i8042prt
 
 
< End of report >
         

--- --- ---

Und hier noch die LanmanCheck-Ausgabe:

DLL im Lanmanworkstation Schlüssel: %SystemRoot%\System32\wkssvc.dll
Geladene DLL: C:\WINDOWS\System32\wkssvc.dll
Signatur der DLL: Microsoft Windows Component Publisher
Rückgabe der Signaturermittlung: Der Vorgang wurde erfolgreich beendet.

MD5 der DLL: 1869B14B06B44B44AF70548E1EA3303F

Alles OK, der Rechner ist nicht vom Lanmanworkstation Trojaner befallen!

Wie geht's jetzt weiter?

Vielen Dank schon mal und viele Grüße

MauriM

Hi,

poste noch das Log vom Killer, ich schaue gerade die OTL-Logs durch...

So, wenn der Killer nichts findet, denke ich das ich was habe (Achtung: Die Datei ist versteckt...)...
Bitte folgende Files prüfen:

Dateien Online überprüfen lassen:

• Als erstes versteckte Dateien anzeigen lassen! (nur Punkt 1 durchführen!)

• Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:

C:\WINDOWS\System32\netrap0.dll
         

• Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)

• Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.

• Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

chris

So, da kommt noch das Log vom Killer

115:24:32.0754 2944 TDSS rootkit removing tool 2.7.41.0 Jun 20 2012 20:53:32
15:24:34.0146 2944 ============================================================
15:24:34.0146 2944 Current date / time: 2012/06/21 15:24:34.0146
15:24:34.0146 2944 SystemInfo:
15:24:34.0146 2944
15:24:34.0146 2944 OS Version: 5.1.2600 ServicePack: 3.0
15:24:34.0146 2944 Product type: Workstation
15:24:34.0146 2944 ComputerName: MUCH-2LMT4R27G4
15:24:34.0146 2944 UserName: Much
15:24:34.0146 2944 Windows directory: C:\WINDOWS
15:24:34.0146 2944 System windows directory: C:\WINDOWS
15:24:34.0146 2944 Processor architecture: Intel x86
15:24:34.0146 2944 Number of processors: 1
15:24:34.0146 2944 Page size: 0x1000
15:24:34.0146 2944 Boot type: Normal boot
15:24:34.0146 2944 ============================================================
15:24:36.0179 2944 Drive \Device\Harddisk0\DR0 - Size: 0x1315740000 (76.34 Gb), SectorSize: 0x200, Cylinders: 0x26EC, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
15:24:36.0189 2944 ============================================================
15:24:36.0189 2944 \Device\Harddisk0\DR0:
15:24:36.0209 2944 MBR partitions:
15:24:36.0209 2944 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3A9A172
15:24:36.0229 2944 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3A9A1F0, BlocksNum 0x5E0DDFC
15:24:36.0229 2944 ============================================================
15:24:36.0299 2944 C: <-> \Device\Harddisk0\DR0\Partition0
15:24:36.0329 2944 D: <-> \Device\Harddisk0\DR0\Partition1
15:24:36.0329 2944 ============================================================
15:24:36.0329 2944 Initialize success
15:24:36.0329 2944 ============================================================
15:24:44.0180 2412 ============================================================
15:24:44.0180 2412 Scan started
15:24:44.0180 2412 Mode: Manual; SigCheck; TDLFS;
15:24:44.0180 2412 ============================================================
15:24:44.0561 2412 Abiosdsk - ok
15:24:44.0611 2412 abp480n5 - ok
15:24:44.0661 2412 ACPI - ok
15:24:44.0741 2412 ACPIEC - ok
15:24:44.0861 2412 AdobeFlashPlayerUpdateSvc (f3cd7b20b27d1772c946df993ff3635c) C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
15:24:45.0302 2412 AdobeFlashPlayerUpdateSvc - ok
15:24:45.0332 2412 adpu160m - ok
15:24:45.0432 2412 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
15:24:46.0103 2412 aec - ok
15:24:46.0203 2412 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
15:24:46.0283 2412 AFD - ok
15:24:46.0314 2412 Aha154x - ok
15:24:46.0364 2412 aic78u2 - ok
15:24:46.0414 2412 aic78xx - ok
15:24:46.0504 2412 Alerter (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
15:24:46.0934 2412 Alerter - ok
15:24:47.0025 2412 ALG (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
15:24:47.0405 2412 ALG - ok
15:24:47.0435 2412 AliIde - ok
15:24:47.0495 2412 amsint - ok
15:24:47.0635 2412 AntiVirScheduler (d6c8942bea3698a2e7559bd423bfa5d7) C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
15:24:47.0655 2412 AntiVirScheduler ( UnsignedFile.Multi.Generic ) - warning
15:24:47.0655 2412 AntiVirScheduler - detected UnsignedFile.Multi.Generic (1)
15:24:47.0816 2412 AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) C:\Programme\Avira\AntiVir Desktop\sched.exe
15:24:47.0866 2412 AntiVirSchedulerService - ok
15:24:47.0916 2412 AntiVirService (a489be6bb0aa1ff406b488b60542314b) C:\Programme\Avira\AntiVir Desktop\avguard.exe
15:24:47.0966 2412 AntiVirService - ok
15:24:48.0026 2412 AppMgmt - ok
15:24:48.0106 2412 asc - ok
15:24:48.0186 2412 asc3350p - ok
15:24:48.0246 2412 asc3550 - ok
15:24:48.0326 2412 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
15:24:48.0767 2412 AsyncMac - ok
15:24:48.0887 2412 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
15:24:49.0318 2412 atapi - ok
15:24:49.0338 2412 Atdisk - ok
15:24:49.0468 2412 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
15:24:49.0859 2412 Atmarpc - ok
15:24:49.0989 2412 AudioSrv (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
15:24:50.0449 2412 AudioSrv - ok
15:24:50.0520 2412 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
15:24:51.0010 2412 audstub - ok
15:24:51.0060 2412 avgntflt (d5541f0afb767e85fc412fc609d96a74) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
15:24:51.0341 2412 avgntflt - ok
15:24:51.0451 2412 avipbb (7d967a682d4694df7fa57d63a2db01fe) C:\WINDOWS\system32\DRIVERS\avipbb.sys
15:24:51.0481 2412 avipbb - ok
15:24:51.0541 2412 avkmgr (53e56450da16a1a7f0d002f511113f67) C:\WINDOWS\system32\DRIVERS\avkmgr.sys
15:24:51.0591 2412 avkmgr - ok
15:24:51.0651 2412 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
15:24:52.0162 2412 Beep - ok
15:24:52.0312 2412 BITS (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
15:24:52.0773 2412 BITS - ok
15:24:52.0863 2412 Browser (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
15:24:53.0284 2412 Browser - ok
15:24:53.0334 2412 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
15:24:53.0824 2412 cbidf2k - ok
15:24:53.0894 2412 cd20xrnt - ok
15:24:53.0985 2412 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
15:24:54.0495 2412 Cdaudio - ok
15:24:54.0575 2412 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
15:24:55.0046 2412 Cdfs - ok
15:24:55.0096 2412 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
15:24:55.0587 2412 Cdrom - ok
15:24:55.0617 2412 Changer - ok
15:24:55.0697 2412 cisvc (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\System32\cisvc.exe
15:24:56.0158 2412 cisvc - ok
15:24:56.0218 2412 ClipSrv (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
15:24:56.0678 2412 ClipSrv - ok
15:24:56.0719 2412 CmdIde - ok
15:24:56.0789 2412 COMSysApp - ok
15:24:56.0909 2412 Cpqarray - ok
15:24:57.0009 2412 CryptSvc (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
15:24:57.0409 2412 CryptSvc - ok
15:24:57.0440 2412 dac2w2k - ok
15:24:57.0500 2412 dac960nt - ok
15:24:57.0640 2412 DcomLaunch (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
15:24:57.0850 2412 DcomLaunch - ok
15:24:57.0920 2412 Dhcp (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
15:24:58.0441 2412 Dhcp - ok
15:24:58.0531 2412 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
15:24:58.0972 2412 Disk - ok
15:24:59.0022 2412 dmadmin - ok
15:24:59.0182 2412 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
15:24:59.0663 2412 dmboot - ok
15:24:59.0773 2412 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
15:25:00.0264 2412 dmio - ok
15:25:00.0344 2412 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
15:25:00.0854 2412 dmload - ok
15:25:00.0955 2412 dmserver (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
15:25:01.0385 2412 dmserver - ok
15:25:01.0435 2412 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
15:25:01.0866 2412 DMusic - ok
15:25:01.0926 2412 Dnscache (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll
15:25:02.0076 2412 Dnscache - ok
15:25:02.0186 2412 Dot3svc (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
15:25:02.0637 2412 Dot3svc - ok
15:25:02.0667 2412 dpti2o - ok
15:25:02.0757 2412 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
15:25:03.0198 2412 drmkaud - ok
15:25:03.0308 2412 EapHost (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
15:25:03.0749 2412 EapHost - ok
15:25:03.0859 2412 ERSvc (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
15:25:04.0349 2412 ERSvc - ok
15:25:04.0470 2412 Eventlog (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
15:25:04.0590 2412 Eventlog - ok
15:25:04.0680 2412 EventSystem (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\System32\es.dll
15:25:04.0720 2412 EventSystem - ok
15:25:04.0830 2412 FA312 (aa855fb8a866281aacb393c1feab91ae) C:\WINDOWS\system32\DRIVERS\FA312nd5.sys
15:25:05.0341 2412 FA312 - ok
15:25:05.0471 2412 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
15:25:05.0892 2412 Fastfat - ok
15:25:05.0992 2412 FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
15:25:06.0062 2412 FastUserSwitchingCompatibility - ok
15:25:06.0112 2412 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
15:25:06.0553 2412 Fdc - ok
15:25:06.0633 2412 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
15:25:07.0093 2412 Fips - ok
15:25:07.0133 2412 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
15:25:07.0594 2412 Flpydisk - ok
15:25:07.0694 2412 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
15:25:08.0175 2412 FltMgr - ok
15:25:08.0255 2412 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
15:25:08.0746 2412 Fs_Rec - ok
15:25:08.0806 2412 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
15:25:09.0447 2412 Ftdisk - ok
15:25:09.0507 2412 gameenum (065639773d8b03f33577f6cdaea21063) C:\WINDOWS\system32\DRIVERS\gameenum.sys
15:25:09.0907 2412 gameenum - ok
15:25:09.0998 2412 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
15:25:10.0458 2412 Gpc - ok
15:25:10.0608 2412 helpsvc (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
15:25:11.0029 2412 helpsvc - ok
15:25:11.0089 2412 HidServ - ok
15:25:11.0179 2412 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
15:25:11.0590 2412 hidusb - ok
15:25:11.0670 2412 hkmsvc (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
15:25:12.0101 2412 hkmsvc - ok
15:25:12.0131 2412 hpn - ok
15:25:12.0201 2412 hpt3xx - ok
15:25:12.0321 2412 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
15:25:12.0371 2412 HTTP - ok
15:25:12.0421 2412 HTTPFilter (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
15:25:12.0872 2412 HTTPFilter - ok
15:25:12.0922 2412 i2omgmt - ok
15:25:12.0972 2412 i2omp - ok
15:25:13.0062 2412 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
15:25:13.0523 2412 i8042prt - ok
15:25:13.0563 2412 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\drivers\Imapi.sys
15:25:13.0983 2412 Imapi - ok
15:25:14.0063 2412 ImapiService (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\System32\imapi.exe
15:25:14.0504 2412 ImapiService - ok
15:25:14.0574 2412 ini910u - ok
15:25:14.0694 2412 IntelIde - ok
15:25:14.0754 2412 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
15:25:15.0225 2412 ip6fw - ok
15:25:15.0325 2412 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
15:25:15.0766 2412 IpFilterDriver - ok
15:25:15.0836 2412 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
15:25:16.0267 2412 IpInIp - ok
15:25:16.0377 2412 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
15:25:16.0817 2412 IpNat - ok
15:25:16.0938 2412 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
15:25:17.0368 2412 IPSec - ok
15:25:17.0438 2412 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
15:25:17.0889 2412 IRENUM - ok
15:25:17.0979 2412 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
15:25:18.0420 2412 isapnp - ok
15:25:18.0540 2412 JavaQuickStarterService (0a5709543986843d37a92290b7838340) C:\Programme\Java\jre6\bin\jqs.exe
15:25:18.0570 2412 JavaQuickStarterService - ok
15:25:18.0670 2412 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
15:25:19.0081 2412 Kbdclass - ok
15:25:19.0131 2412 kbdhid (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
15:25:19.0581 2412 kbdhid - ok
15:25:19.0661 2412 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
15:25:20.0082 2412 kmixer - ok
15:25:20.0172 2412 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
15:25:20.0232 2412 KSecDD - ok
15:25:20.0362 2412 lanmanserver (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
15:25:20.0433 2412 lanmanserver - ok
15:25:20.0553 2412 lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
15:25:20.0633 2412 lanmanworkstation - ok
15:25:20.0693 2412 lbrtfdc - ok
15:25:20.0833 2412 LmHosts (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
15:25:21.0955 2412 LmHosts - ok
15:25:22.0055 2412 MBAMProtector (fb097bbc1a18f044bd17bd2fccf97865) C:\WINDOWS\system32\drivers\mbam.sys
15:25:22.0115 2412 MBAMProtector - ok
15:25:22.0285 2412 MBAMService (ba400ed640bca1eae5c727ae17c10207) C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
15:25:22.0405 2412 MBAMService - ok
15:25:22.0466 2412 Messenger (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
15:25:22.0926 2412 Messenger - ok
15:25:23.0026 2412 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
15:25:23.0517 2412 mnmdd - ok
15:25:23.0567 2412 mnmsrvc (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\System32\mnmsrvc.exe
15:25:23.0988 2412 mnmsrvc - ok
15:25:24.0068 2412 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
15:25:24.0478 2412 Modem - ok
15:25:24.0539 2412 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
15:25:24.0969 2412 Mouclass - ok
15:25:25.0009 2412 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
15:25:25.0520 2412 mouhid - ok
15:25:25.0590 2412 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
15:25:25.0941 2412 MountMgr - ok
15:25:26.0081 2412 MozillaMaintenance (15d5398eed42c2504bb3d4fc875c15d1) C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe
15:25:26.0121 2412 MozillaMaintenance - ok
15:25:26.0221 2412 MpKsl37b649c1 - ok
15:25:26.0281 2412 mraid35x - ok
15:25:26.0371 2412 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
15:25:26.0822 2412 MRxDAV - ok
15:25:26.0962 2412 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
15:25:27.0072 2412 MRxSmb - ok
15:25:27.0142 2412 MSDTC (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\System32\msdtc.exe
15:25:27.0543 2412 MSDTC - ok
15:25:27.0593 2412 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
15:25:28.0014 2412 Msfs - ok
15:25:28.0064 2412 MSIServer - ok
15:25:28.0154 2412 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
15:25:28.0594 2412 MSKSSRV - ok
15:25:28.0654 2412 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
15:25:29.0065 2412 MSPCLOCK - ok
15:25:29.0105 2412 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
15:25:29.0486 2412 MSPQM - ok
15:25:29.0596 2412 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
15:25:29.0986 2412 mssmbios - ok
15:25:30.0056 2412 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
15:25:30.0117 2412 Mup - ok
15:25:30.0257 2412 napagent (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
15:25:30.0667 2412 napagent - ok
15:25:30.0767 2412 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
15:25:31.0198 2412 NDIS - ok
15:25:31.0308 2412 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
15:25:31.0358 2412 NdisTapi - ok
15:25:31.0398 2412 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
15:25:31.0839 2412 Ndisuio - ok
15:25:31.0939 2412 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
15:25:32.0310 2412 NdisWan - ok
15:25:32.0430 2412 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
15:25:32.0500 2412 NDProxy - ok
15:25:32.0560 2412 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
15:25:32.0971 2412 NetBIOS - ok
15:25:33.0071 2412 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
15:25:33.0431 2412 NetBT - ok
15:25:33.0561 2412 NetDDE (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
15:25:33.0952 2412 NetDDE - ok
15:25:34.0002 2412 NetDDEdsdm (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
15:25:34.0403 2412 NetDDEdsdm - ok
15:25:34.0443 2412 Netlogon (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\System32\lsass.exe
15:25:34.0893 2412 Netlogon - ok
15:25:35.0004 2412 Netman (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
15:25:35.0454 2412 Netman - ok
15:25:35.0554 2412 Nla (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
15:25:35.0725 2412 Nla - ok
15:25:35.0785 2412 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
15:25:36.0195 2412 Npfs - ok
15:25:36.0245 2412 NtApm (5061d3d7e8d7bdef0cb1c764af9f68f9) C:\WINDOWS\system32\DRIVERS\NtApm.sys
15:25:36.0506 2412 NtApm - ok
15:25:36.0676 2412 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
15:25:37.0197 2412 Ntfs - ok
15:25:37.0227 2412 NtLmSsp (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\System32\lsass.exe
15:25:37.0667 2412 NtLmSsp - ok
15:25:37.0848 2412 NtmsSvc (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
15:25:38.0228 2412 NtmsSvc - ok
15:25:38.0318 2412 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
15:25:38.0749 2412 Null - ok
15:25:39.0099 2412 nv (2b298519edbfcf451d43e0f1e8f1006d) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
15:25:39.0590 2412 nv - ok
15:25:39.0790 2412 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
15:25:40.0241 2412 NwlnkFlt - ok
15:25:40.0311 2412 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
15:25:40.0882 2412 NwlnkFwd - ok
15:25:40.0972 2412 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
15:25:41.0383 2412 Parport - ok
15:25:41.0423 2412 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
15:25:41.0853 2412 PartMgr - ok
15:25:41.0924 2412 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
15:25:42.0514 2412 ParVdm - ok
15:25:42.0594 2412 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
15:25:42.0995 2412 PCI - ok
15:25:43.0055 2412 PCIDump - ok
15:25:43.0115 2412 PCIIde - ok
15:25:43.0225 2412 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
15:25:43.0656 2412 Pcmcia - ok
15:25:43.0716 2412 PDCOMP - ok
15:25:43.0766 2412 PDFRAME - ok
15:25:43.0816 2412 PDRELI - ok
15:25:43.0916 2412 PDRFRAME - ok
15:25:43.0966 2412 perc2 - ok
15:25:44.0017 2412 perc2hib - ok
15:25:44.0247 2412 PlugPlay (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
15:25:44.0397 2412 PlugPlay - ok
15:25:44.0477 2412 PolicyAgent (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\System32\lsass.exe
15:25:44.0888 2412 PolicyAgent - ok
15:25:44.0988 2412 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
15:25:45.0388 2412 PptpMiniport - ok
15:25:45.0439 2412 ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
15:25:45.0849 2412 ProtectedStorage - ok
15:25:45.0879 2412 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
15:25:46.0340 2412 PSched - ok
15:25:46.0460 2412 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
15:25:47.0021 2412 Ptilink - ok
15:25:47.0051 2412 ql1080 - ok
15:25:47.0131 2412 Ql10wnt - ok
15:25:47.0221 2412 ql12160 - ok
15:25:47.0251 2412 ql1240 - ok
15:25:47.0331 2412 ql1280 - ok
15:25:47.0391 2412 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
15:25:47.0942 2412 RasAcd - ok
15:25:48.0022 2412 RasAuto (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
15:25:48.0433 2412 RasAuto - ok
15:25:48.0503 2412 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
15:25:48.0944 2412 Rasl2tp - ok
15:25:49.0044 2412 RasMan (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
15:25:49.0514 2412 RasMan - ok
15:25:49.0564 2412 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
15:25:49.0995 2412 RasPppoe - ok
15:25:50.0035 2412 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
15:25:50.0646 2412 Raspti - ok
15:25:50.0756 2412 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
15:25:51.0197 2412 Rdbss - ok
15:25:51.0247 2412 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
15:25:51.0868 2412 RDPCDD - ok
15:25:52.0028 2412 RDPWD (6589db6e5969f8eee594cf71171c5028) C:\WINDOWS\system32\drivers\RDPWD.sys
15:25:52.0118 2412 RDPWD - ok
15:25:52.0228 2412 RDSessMgr (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
15:25:52.0639 2412 RDSessMgr - ok
15:25:52.0729 2412 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
15:25:53.0130 2412 redbook - ok
15:25:53.0180 2412 RemoteAccess (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
15:25:53.0620 2412 RemoteAccess - ok
15:25:53.0710 2412 RpcLocator (2a02e21867497df20b8fc95631395169) C:\WINDOWS\System32\locator.exe
15:25:54.0131 2412 RpcLocator - ok
15:25:54.0241 2412 RpcSs (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
15:25:54.0401 2412 RpcSs - ok
15:25:54.0502 2412 RSVP (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\System32\rsvp.exe
15:25:55.0022 2412 RSVP - ok
15:25:55.0092 2412 SamSs (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
15:25:55.0473 2412 SamSs - ok
15:25:55.0553 2412 SCardSvr (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
15:25:56.0004 2412 SCardSvr - ok
15:25:56.0124 2412 Schedule (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
15:25:56.0575 2412 Schedule - ok
15:25:56.0685 2412 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
15:25:57.0075 2412 Secdrv - ok
15:25:57.0205 2412 seclogon (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
15:25:57.0626 2412 seclogon - ok
15:25:57.0696 2412 SENS (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
15:25:58.0107 2412 SENS - ok
15:25:58.0167 2412 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
15:25:58.0618 2412 serenum - ok
15:25:58.0738 2412 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\DRIVERS\serial.sys
15:25:59.0168 2412 Serial - ok
15:25:59.0238 2412 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
15:25:59.0669 2412 Sfloppy - ok
15:25:59.0809 2412 SharedAccess (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
15:26:00.0250 2412 SharedAccess - ok
15:26:00.0350 2412 ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
15:26:00.0400 2412 ShellHWDetection - ok
15:26:00.0430 2412 Simbad - ok
15:26:00.0470 2412 Sparrow - ok
15:26:00.0570 2412 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
15:26:01.0011 2412 splitter - ok
15:26:01.0101 2412 Spooler (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
15:26:01.0171 2412 Spooler - ok
15:26:01.0211 2412 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
15:26:01.0672 2412 sr - ok
15:26:01.0772 2412 srservice (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\System32\srsvc.dll
15:26:02.0213 2412 srservice - ok
15:26:02.0323 2412 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
15:26:02.0473 2412 Srv - ok
15:26:02.0543 2412 SSDPSRV (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
15:26:02.0944 2412 SSDPSRV - ok
15:26:03.0014 2412 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
15:26:03.0054 2412 ssmdrv - ok
15:26:03.0204 2412 stisvc (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
15:26:03.0595 2412 stisvc - ok
15:26:03.0665 2412 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
15:26:04.0075 2412 swenum - ok
15:26:04.0155 2412 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
15:26:04.0596 2412 swmidi - ok
15:26:04.0666 2412 SwPrv - ok
15:26:04.0746 2412 symc810 - ok
15:26:04.0796 2412 symc8xx - ok
15:26:04.0866 2412 sym_hi - ok
15:26:04.0937 2412 sym_u3 - ok
15:26:04.0997 2412 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
15:26:05.0407 2412 sysaudio - ok
15:26:05.0517 2412 SysmonLog (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
15:26:05.0978 2412 SysmonLog - ok
15:26:06.0118 2412 TapiSrv (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
15:26:06.0569 2412 TapiSrv - ok
15:26:06.0709 2412 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
15:26:06.0909 2412 Tcpip - ok
15:26:06.0960 2412 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
15:26:07.0420 2412 TDPIPE - ok
15:26:07.0490 2412 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
15:26:07.0871 2412 TDTCP - ok
15:26:07.0971 2412 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
15:26:08.0382 2412 TermDD - ok
15:26:08.0522 2412 TermService (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
15:26:08.0932 2412 TermService - ok
15:26:09.0032 2412 Themes (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
15:26:09.0093 2412 Themes - ok
15:26:09.0123 2412 TosIde - ok
15:26:09.0233 2412 TrkWks (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
15:26:09.0623 2412 TrkWks - ok
15:26:09.0703 2412 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
15:26:10.0174 2412 Udfs - ok
15:26:10.0224 2412 ultra - ok
15:26:10.0344 2412 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
15:26:10.0795 2412 Update - ok
15:26:10.0895 2412 upnphost (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
15:26:11.0296 2412 upnphost - ok
15:26:11.0386 2412 UPS (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
15:26:11.0756 2412 UPS - ok
15:26:11.0847 2412 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
15:26:12.0227 2412 usbhub - ok
15:26:12.0317 2412 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
15:26:12.0698 2412 usbscan - ok
15:26:12.0808 2412 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
15:26:13.0198 2412 USBSTOR - ok
15:26:13.0249 2412 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
15:26:13.0629 2412 usbuhci - ok
15:26:13.0749 2412 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
15:26:14.0120 2412 VgaSave - ok
15:26:14.0220 2412 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
15:26:14.0590 2412 viaagp - ok
15:26:14.0651 2412 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
15:26:15.0081 2412 ViaIde - ok
15:26:15.0191 2412 VIAudio (819bf44085104be6527b86a88acf856b) C:\WINDOWS\system32\drivers\ac97via.sys
15:26:15.0512 2412 VIAudio - ok
15:26:15.0582 2412 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
15:26:16.0003 2412 VolSnap - ok
15:26:16.0143 2412 VSS (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
15:26:16.0583 2412 VSS - ok
15:26:16.0683 2412 W32Time (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\System32\w32time.dll
15:26:17.0104 2412 W32Time - ok
15:26:17.0204 2412 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
15:26:17.0615 2412 Wanarp - ok
15:26:17.0685 2412 WDICA - ok
15:26:17.0765 2412 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
15:26:18.0166 2412 wdmaud - ok
15:26:18.0246 2412 WebClient (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
15:26:18.0656 2412 WebClient - ok
15:26:18.0776 2412 winmgmt (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
15:26:19.0157 2412 winmgmt - ok
15:26:19.0277 2412 WmdmPmSN (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
15:26:19.0377 2412 WmdmPmSN - ok
15:26:19.0498 2412 WmiApSrv (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\System32\wbem\wmiapsrv.exe
15:26:19.0918 2412 WmiApSrv - ok
15:26:20.0179 2412 WMPNetworkSvc (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe
15:26:20.0369 2412 WMPNetworkSvc - ok
15:26:20.0419 2412 wscsvc (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
15:26:20.0839 2412 wscsvc - ok
15:26:20.0940 2412 wuauserv (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
15:26:21.0991 2412 wuauserv - ok
15:26:22.0101 2412 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
15:26:22.0171 2412 WudfPf - ok
15:26:22.0211 2412 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
15:26:22.0302 2412 WudfRd - ok
15:26:22.0402 2412 WudfSvc (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
15:26:22.0472 2412 WudfSvc - ok
15:26:22.0632 2412 WZCSVC (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
15:26:23.0033 2412 WZCSVC - ok
15:26:23.0133 2412 xmlprov (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
15:26:23.0563 2412 xmlprov - ok
15:26:23.0633 2412 MBR (0x1B8) (72b8ce41af0de751c946802b3ed844b4) \Device\Harddisk0\DR0
15:26:24.0865 2412 \Device\Harddisk0\DR0 - ok
15:26:24.0915 2412 Boot (0x1200) (ce8a266d5b09a0ed9d85bb119e2665b0) \Device\Harddisk0\DR0\Partition0
15:26:24.0935 2412 \Device\Harddisk0\DR0\Partition0 - ok
15:26:24.0975 2412 Boot (0x1200) (039e79106525e9e48b34dc019643b119) \Device\Harddisk0\DR0\Partition1
15:26:24.0985 2412 \Device\Harddisk0\DR0\Partition1 - ok
15:26:24.0995 2412 ============================================================
15:26:24.0995 2412 Scan finished
15:26:24.0995 2412 ============================================================
15:26:25.0156 3364 Detected object count: 1
15:26:25.0156 3364 Actual detected object count: 1
15:26:32.0156 3364 AntiVirScheduler ( UnsignedFile.Multi.Generic ) - skipped by user
15:26:32.0156 3364 AntiVirScheduler ( UnsignedFile.Multi.Generic ) - User select action: Skip

Hi,

ok, scheint kein TDSS zu sein, prüfe mal die angegebene Datei bei Virustotal..

chris

Hallo Chris,

also irgendwie kriege ich das mit dem virustotal nicht hin. Beim Upload der Datei sagt er als letztes: computing hash ...

dann passiert aber nichts mehr, man sieht keinerlei Hochladefortschritt oder so.

Kannst Du mir weiterhelfen?

Schöne Grüße

Mauritius

Hi,

schwierig, ich würde das Teil mal "abschießen"...

Fix für OTL:

• Doppelklick auf die OTL.exe, um das Programm auszuführen.

• Vista/Win7-User bitte per Rechtsklick und "Ausführen als Administrator" starten.

• Kopiere den Inhalt der folgenden Codebox komplett in die OTL-Box unter "Custom Scan/Fixes"

:OTL
[2012.04.24 15:02:40 | 000,139,264 | RHS- | C] () -- C:\WINDOWS\System32\netrap0.dll
O4 - HKCU..\Run: [api32] C:\DOKUME~1\MUCH~1.MUC\LOKALE~1\Temp\apiqq.exe File not found

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusOverride" = dword:0x00

:Commands
[emptytemp]
[CREATERESTOREPOINT]
[Reboot]
         

• Den roten Run Fixes! Button anklicken.

• Bitte alles aus dem Ergebnisfenster (Results) herauskopieren.

• Eine Kopie eines OTL-Fix-Logs wird in einer Textdatei in folgendem Ordner gespeichert:

• %systemroot%\_OTL

chris

Hallo Chris,

sorry, hat jetzt etwas länger gedauert, bis ich dir den OTL-Log schicken kann.

Hier ist er:
All processes killed
========== OTL ==========
C:\WINDOWS\system32\netrap0.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\api32 deleted successfully.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\"AntiVirusOverride" | dword:0x00 /E : value set successfully!
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: All Users.WINDOWS

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User.WINDOWS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService.NT-AUTORITÄT
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService.NT-AUTORITÄT.000
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Much
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes

User: Much.JULIAN-323B97E3
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Much.MUCH-2LMT4R27G4
->Temp folder emptied: 257000254 bytes
->Temporary Internet Files folder emptied: 135275425 bytes
->Java cache emptied: 15943379 bytes
->FireFox cache emptied: 369911233 bytes
->Flash cache emptied: 148024 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService.NT-AUTORITÄT
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService.NT-AUTORITÄT.000
->Temp folder emptied: 1082628 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 1138908 bytes
%systemroot%\System32 .tmp files removed: 4528519 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 6637726 bytes
RecycleBin emptied: 3092628348 bytes

Total Files Cleaned = 3.704,00 mb

Wie geht's denn jetzt weiter?

Schöne Grüße

MauriM

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.50.0 log created on 06222012_101221

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Hi,

bitte ein neues OTL-Log posten, ich denke das was noch nicht alles. Mit ist noch ein JOB aufgefallen, der seltsam aussieht:
[2012.06.21 12:55:06 | 000,000,310 | ---- | M] () -- C:\WINDOWS\tasks\EJJM.job...
U.U. stellt der die gelöscht Malware wieder her...

Sind noch Umleitungen da?

chris

Hey Chris,

sorry, hier kommt ein neues OTL-Log

All processes killed
========== OTL ==========
File C:\WINDOWS\System32\netrap0.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\api32 not found.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\\"AntiVirusOverride" | dword:0x00 /E : value set successfully!
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: All Users.WINDOWS

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User.WINDOWS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService.NT-AUTORITÄT
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService.NT-AUTORITÄT.000
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Much
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes

User: Much.JULIAN-323B97E3
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Much.MUCH-2LMT4R27G4
->Temp folder emptied: 17916 bytes
->Temporary Internet Files folder emptied: 33300 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 11768447 bytes
->Flash cache emptied: 492 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService.NT-AUTORITÄT
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService.NT-AUTORITÄT.000
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 11,00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.50.0 log created on 06222012_110221

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


Ich habe jetzt bei Google ein paar Mal probiert, bisher wurde ich nicht umgeleitet. Aber das muss nicht heißen, dass es nicht wieder passiert. Denn ich bin nicht immer umgeleitet worden auf rocketnews ...

Was ist mit dem JOB?

Schöne Grüße

MauriM

Hi,

ein OTL-Log wie ganz am Anfang erstellen, nicht das Script abfahren...

Der JOB muss gekillt werden...

chris

Hallo Chris,

sorry, dass das bei mir so lange dauert. Ich bin wirklich technisch nicht sonderlich geschickt. Vielen Dank für Deine Geduld.

So, hier kommt das neue OTL-Log:OTL Logfile:

OTL logfile created on: 22.06.2012 11:46:57 - Run 2
OTL by OldTimer - Version 3.2.50.0     Folder = C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
511,49 Mb Total Physical Memory | 249,80 Mb Available Physical Memory | 48,84% Memory free
1,22 Gb Paging File | 0,78 Gb Available in Paging File | 63,95% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 29,30 Gb Total Space | 11,94 Gb Free Space | 40,74% Space Free | Partition Type: NTFS
Drive D: | 47,03 Gb Total Space | 41,74 Gb Free Space | 88,76% Space Free | Partition Type: NTFS
 
Computer Name: MUCH-2LMT4R27G4 | User Name: Much | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_257.dll ()
MOD - C:\Programme\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - C:\Programme\Adobe\Reader 9.0\Reader\ViewerPS.dll ()
MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU ()
MOD - C:\WINDOWS\system32\redmonnt.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found
SRV - (AppMgmt) -- %SystemRoot%\System32\appmgmts.dll File not found
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirScheduler) -- C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe (Avira GmbH)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WDICA) --  File not found
DRV - (PDRFRAME) --  File not found
DRV - (PDRELI) --  File not found
DRV - (PDFRAME) --  File not found
DRV - (PDCOMP) --  File not found
DRV - (PCIDump) --  File not found
DRV - (MpKsl37b649c1) -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{6B8382E0-02A9-4E14-8C6B-CA6772B89399}\MpKsl37b649c1.sys File not found
DRV - (lbrtfdc) --  File not found
DRV - (i2omgmt) --  File not found
DRV - (Changer) --  File not found
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avkmgr) -- C:\WINDOWS\system32\drivers\avkmgr.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (VIAudio) VIA AC'97 Audiocontroller (WDM) -- C:\WINDOWS\system32\drivers\ac97via.sys (VIA Technologies, Inc.)
DRV - (NtApm) -- C:\WINDOWS\system32\drivers\NtApm.sys (Microsoft Corporation)
DRV - (FA312) -- C:\WINDOWS\system32\drivers\FA312nd5.sys (NETGEAR Corp.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = 
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_257.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Programme\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Programme\Mozilla Firefox\components [2012.06.18 13:55:39 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2012.04.13 10:16:33 | 000,000,000 | ---D | M]
 
[2010.05.03 13:03:11 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Mozilla\Extensions
[2012.05.02 09:31:35 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Mozilla\Firefox\Profiles\vddbd5sr.default\extensions
[2011.11.22 11:56:14 | 000,000,000 | ---D | M] (20-20 3D Viewer - IKEA) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Mozilla\Firefox\Profiles\vddbd5sr.default\extensions\2020Player_IKEA@2020Technologies.com
[2011.12.19 13:18:12 | 000,000,933 | ---- | M] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Mozilla\Firefox\Profiles\vddbd5sr.default\searchplugins\11-suche.xml
[2011.12.19 13:18:12 | 000,002,419 | ---- | M] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Mozilla\Firefox\Profiles\vddbd5sr.default\searchplugins\englische-ergebnisse.xml
[2011.12.19 13:18:12 | 000,010,525 | ---- | M] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Mozilla\Firefox\Profiles\vddbd5sr.default\searchplugins\gmx-suche.xml
[2011.12.19 13:18:12 | 000,002,457 | ---- | M] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Mozilla\Firefox\Profiles\vddbd5sr.default\searchplugins\lastminute.xml
[2011.12.19 13:18:12 | 000,005,508 | ---- | M] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Mozilla\Firefox\Profiles\vddbd5sr.default\searchplugins\webde-suche.xml
[2012.06.06 18:12:38 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.04.17 12:53:29 | 000,576,958 | ---- | M] () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\MUCH.MUCH-2LMT4R27G4\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\VDDBD5SR.DEFAULT\EXTENSIONS\TOOLBAR@WEB.DE.XPI
[2012.06.18 13:55:39 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2012.03.07 15:50:47 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2012.06.01 18:33:00 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.01 18:33:00 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2012.06.01 18:33:00 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.01 18:33:00 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.01 18:33:00 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.01 18:33:00 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2001.08.23 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} https://sphinx.zdf.de/sphinx3/smsx.cab (MeadCo ScriptX)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1272889079111 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1272889161649 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {F5131C24-E56D-11CF-B78A-444553540000} https://sphinx.zdf.de/sphinx3/zdfmenu.cab (Ikonic Menu Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.109.123.196 213.191.74.18
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A5BB5F0E-1522-4595-A25E-D634154E6B57}: DhcpNameServer = 62.109.123.196 213.191.74.18
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.04.13 11:26:07 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.21 14:57:26 | 000,000,000 | ---D | C] -- C:\tdsskiller
[2012.06.21 14:45:48 | 000,619,957 | ---- | C] (No company) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\LanmanCheck.exe
[2012.06.21 12:58:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution
[2012.06.20 18:27:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Anwendungsdaten\Malwarebytes
[2012.06.20 18:27:49 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Malwarebytes
[2012.06.20 18:26:43 | 010,063,000 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\mbam-setup-1.61.0.1400.exe
[2012.06.20 18:18:17 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.06.20 18:15:05 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\OTL.exe
[2012.06.14 10:54:35 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Eigene Dateien\ADAC
[2012.06.14 09:44:31 | 000,521,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsdbgui.dll
[2011.03.29 11:08:31 | 012,420,392 | ---- | C] (Mozilla) -- C:\Programme\Firefox Setup 4.0.exe
[2011.03.29 10:28:23 | 012,721,056 | ---- | C] (Mozilla) -- C:\Programme\GMX_MFF4_Setup.exe
[2011.01.18 18:12:43 | 038,808,920 | ---- | C] (Microsoft Corporation) -- C:\Programme\FileFormatConverters.exe
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.22 11:39:06 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012.06.22 11:04:27 | 000,013,002 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012.06.22 11:04:18 | 000,000,310 | ---- | M] () -- C:\WINDOWS\tasks\EJJM.job
[2012.06.22 11:04:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012.06.21 14:56:52 | 002,109,806 | ---- | M] () -- C:\tdsskiller.zip
[2012.06.21 14:45:49 | 000,619,957 | ---- | M] (No company) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\LanmanCheck.exe
[2012.06.20 18:26:52 | 010,063,000 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\mbam-setup-1.61.0.1400.exe
[2012.06.20 18:15:06 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\OTL.exe
[2012.06.20 16:49:55 | 000,215,836 | ---- | M] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\Cuneo_map.png
[2012.06.14 10:13:24 | 000,130,096 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012.06.14 10:05:10 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012.06.14 09:42:16 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2012.06.14 09:42:15 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012.06.06 18:12:47 | 000,000,696 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users.WINDOWS\Desktop\Mozilla Firefox.lnk
[2012.06.05 18:23:10 | 000,252,260 | ---- | M] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\EM_Spielplan.pdf
[2012.06.02 15:19:38 | 000,329,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wucltui.dll
[2012.06.02 15:19:38 | 000,329,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wucltui.dll
[2012.06.02 15:19:38 | 000,219,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuaucpl.cpl
[2012.06.02 15:19:38 | 000,210,968 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuweb.dll
[2012.06.02 15:19:38 | 000,015,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wuapi.dll.mui
[2012.06.02 15:19:34 | 000,097,304 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\cdm.dll
[2012.06.02 15:19:34 | 000,097,304 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\cdm.dll
[2012.06.02 15:19:34 | 000,053,784 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuauclt.exe
[2012.06.02 15:19:34 | 000,045,080 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wups2.dll
[2012.06.02 15:19:34 | 000,035,864 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wups.dll
[2012.06.02 15:19:34 | 000,035,864 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wups.dll
[2012.06.02 15:19:28 | 000,023,576 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wucltui.dll.mui
[2012.06.02 15:19:24 | 000,577,048 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wuapi.dll
[2012.06.02 15:19:24 | 000,577,048 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuapi.dll
[2012.06.02 15:19:18 | 001,933,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wuaueng.dll
[2012.06.02 15:18:58 | 000,275,696 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll
[2012.06.02 15:18:58 | 000,018,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll.mui
[2012.05.31 15:22:01 | 000,604,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\crypt32.dll
 
========== Files Created - No Company Name ==========
 
[2012.06.21 14:56:51 | 002,109,806 | ---- | C] () -- C:\tdsskiller.zip
[2012.06.20 16:49:42 | 000,215,836 | ---- | C] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\Cuneo_map.png
[2012.06.05 18:23:10 | 000,252,260 | ---- | C] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop\EM_Spielplan.pdf
[2012.02.15 11:10:58 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2011.02.22 16:27:04 | 000,003,584 | ---- | C] () -- C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

< End of report >
         

--- --- ---

und da ist noch das andere:OTL Logfile:

OTL Extras logfile created on: 22.06.2012 11:46:57 - Run 2
OTL by OldTimer - Version 3.2.50.0     Folder = C:\Dokumente und Einstellungen\Much.MUCH-2LMT4R27G4\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
511,49 Mb Total Physical Memory | 249,80 Mb Available Physical Memory | 48,84% Memory free
1,22 Gb Paging File | 0,78 Gb Available in Paging File | 63,95% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 29,30 Gb Total Space | 11,94 Gb Free Space | 40,74% Space Free | Partition Type: NTFS
Drive D: | 47,03 Gb Total Space | 41,74 Gb Free Space | 88,76% Space Free | Partition Type: NTFS
 
Computer Name: MUCH-2LMT4R27G4 | User Name: Much | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:TCP" = 1900:TCP:LocalSubNet:Enabled:UDP 1900
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\Temp\NavBrowser.exe" = C:\WINDOWS\Temp\NavBrowser.exe:*:Enabled:NAVBrowser
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E0131B2-CF18-40D9-A331-60A3746C1204}" = EPSON Scan
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6C11D561-620B-47DA-A693-4C597F3CDF40}" = EPSON Smart Panel
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{913D0407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Standard für Schüler, Studierende und Lehrkräfte
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DBEA589-5202-4504-90AE-97A73F139FE4}" = EPSON Photo Print
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.1 - Deutsch
"{B69CC1A5-0404-11D6-ABCB-005004C21D30}" = EPSON Copy Utility
"{EBAE381B-60A6-4863-AA9F-FCAB755BC9E5}" = ScanToWeb
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira Free Antivirus
"Digital Editions" = Adobe Digital Editions
"FreePDF_XP" = FreePDF (Remove only)
"GPL Ghostscript 8.71" = GPL Ghostscript 8.71
"ie8" = Windows Internet Explorer 8
"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"P2400P Reference Guide" = P2400P Reference Guide
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 10.03.2011 11:01:11 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung WINWORD.EXE, Version 10.0.6866.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 14.03.2011 05:18:21 | Computer Name = MUCH-2LMT4R27G4 | Source = MPSampleSubmission | ID = 5000
Description = 
 
Error - 15.03.2011 05:26:41 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 1.9.2.4079, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 16.03.2011 05:17:10 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 1.9.2.4079, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 16.03.2011 05:17:21 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung plugin-container.exe, Version 1.9.2.4079,
 fehlgeschlagenes Modul ntdll.dll, Version 5.1.2600.6055, Fehleradresse 0x0000100b.
 
Error - 11.04.2011 05:28:21 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung WINWORD.EXE, Version 10.0.6866.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 11.04.2011 05:30:55 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung WINWORD.EXE, Version 10.0.6866.0, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 11.04.2011 05:30:58 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Hang | ID = 1001
Description = Fehlerhafter Speicherbereich 2058850643.
 
Error - 13.04.2011 06:14:32 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 2.0.0.4094, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 13.04.2011 06:14:41 | Computer Name = MUCH-2LMT4R27G4 | Source = Application Hang | ID = 1001
Description = Fehlerhafter Speicherbereich -1935456019.
 
[ System Events ]
Error - 21.06.2012 10:51:08 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   i8042prt
 
Error - 21.06.2012 11:40:26 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   i8042prt
 
Error - 21.06.2012 11:46:53 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   i8042prt
 
Error - 22.06.2012 03:55:10 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   i8042prt
 
Error - 22.06.2012 04:12:23 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7034
Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 22.06.2012 04:24:11 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   i8042prt
 
Error - 22.06.2012 05:02:23 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7034
Description = Dienst "Java Quick Starter" wurde unerwartet beendet. Dies ist bereits
 1 Mal passiert.
 
Error - 22.06.2012 05:06:08 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   i8042prt
 
Error - 22.06.2012 05:06:08 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst WMI-Leistungsadapter.
 
Error - 22.06.2012 05:06:08 | Computer Name = MUCH-2LMT4R27G4 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "WMI-Leistungsadapter" wurde aufgrund folgenden Fehlers
 nicht gestartet:   %%1053
 
 
< End of report >
         

--- --- ---

Und wie lösche ich jetzt den JOB genau?

Hi,

• Doppelklick auf die OTL.exe, um das Programm auszuführen.

• Vista/Win7-User bitte per Rechtsklick und "Ausführen als Administrator" starten.

• Kopiere den Inhalt der folgenden Codebox komplett in die OTL-Box unter "Custom Scan/Fixes"

:OTL
[2012.06.22 11:04:18 | 000,000,310 | ---- | M] () -- C:\WINDOWS\tasks\EJJM.job

:Commands
[purity]
[emptytemp]
[Reboot]
         

• Den roten Run Fixes! Button anklicken.

• Bitte alles aus dem Ergebnisfenster (Results) herauskopieren.

• Eine Kopie eines OTL-Fix-Logs wird in einer Textdatei in folgendem Ordner gespeichert:

• %systemroot%\_OTL

Bitte das Verzeichnis C:\_OTL\MovedFiles packen und wie folgt bei uns hochladen...

Datei hochladen:
http://www.trojaner-board.de/54791-a...ner-board.html
Folge den Anweisungen dort ...

In die Beschreibung bitte meinen nick aufnehmen, dann finde ich es schneller...

chris

Hey Chris,

also hier kommt das Log:

All processes killed
========== OTL ==========
C:\WINDOWS\tasks\EJJM.job moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: All Users.WINDOWS

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User.WINDOWS
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService.NT-AUTORITÄT
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService.NT-AUTORITÄT.000
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Much
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes

User: Much.JULIAN-323B97E3
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Much.MUCH-2LMT4R27G4
->Temp folder emptied: 17916 bytes
->Temporary Internet Files folder emptied: 33300 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 33165506 bytes
->Flash cache emptied: 492 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService.NT-AUTORITÄT
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: NetworkService.NT-AUTORITÄT.000
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 32,00 mb


OTL by OldTimer - Version 3.2.50.0 log created on 06222012_122912

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Das Movedfiles ist hochgeladen, allerdings kann ich das %systemroot%\_OTL nicht finden, aber ich fürchte, da bin ich wieder mal zu doof für ...