BundesPolizei Trojaner auf dem PC

Dremml · 31.07.2012, 18:19

Guten Abend,

nun hat es auch nich erwischt.
Habe vorhin den PC angemacht, kurz darauf ist der bekannte Screen erschienen, auf dem steht, daß die BundesPolizei den PC gesperrt hat und ich 100 Euro bezahlen soll.

Ich habe mir die OTL.exe von euch runtergeladen und den ersten Scan gemacht.

Hier mal die Ergebnisse der OTL.txt und der Extras.txt
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 31.07.2012 18:49:23 - Run 1
OTL by OldTimer - Version 3.2.55.0     Folder = G:\Dokumente und Einstellungen\Administrator.ASDF-MK16U3WZZC\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,76 Gb Available Physical Memory | 88,06% Memory free
3,71 Gb Paging File | 3,65 Gb Available in Paging File | 98,50% Paging File free
Paging file location(s): F:\pagefile.sys 1900 1900 [binary data]
 
%SystemDrive% = G: | %SystemRoot% = G:\WINDOWS | %ProgramFiles% = G:\Programme
Drive C: | 10,41 Gb Total Space | 6,61 Gb Free Space | 63,47% Space Free | Partition Type: NTFS
Drive D: | 57,26 Gb Total Space | 5,71 Gb Free Space | 9,97% Space Free | Partition Type: NTFS
Drive E: | 57,26 Gb Total Space | 7,45 Gb Free Space | 13,02% Space Free | Partition Type: NTFS
Drive F: | 2,17 Gb Total Space | 0,30 Gb Free Space | 13,65% Space Free | Partition Type: NTFS
Drive G: | 59,01 Gb Total Space | 5,10 Gb Free Space | 8,64% Space Free | Partition Type: NTFS
Drive H: | 501,02 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive J: | 121,53 Mb Total Space | 118,24 Mb Free Space | 97,29% Space Free | Partition Type: FAT32
 
Computer Name: ASDF-MK16U3WZZC | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2007.06.13 15:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) -- G:\WINDOWS\explorer.exe
PRC - [1988.01.01 00:09:06 | 000,597,504 | ---- | M] (OldTimer Tools) -- G:\Dokumente und Einstellungen\Administrator.ASDF-MK16U3WZZC\Desktop\OTL.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.04.04 07:53:56 | 000,301,056 | ---- | M] () -- G:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
MOD - [2011.05.28 23:04:56 | 000,140,288 | ---- | M] () -- G:\Programme\WinRAR\RarExt.dll
MOD - [2006.10.22 12:22:00 | 000,466,944 | ---- | M] () -- G:\WINDOWS\system32\nvshell.dll
MOD - [2006.10.22 12:22:00 | 000,212,992 | ---- | M] () -- G:\WINDOWS\system32\nvapi.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.06.26 21:41:57 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- G:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2011.09.19 16:58:26 | 000,087,368 | ---- | M] (Nero AG) [Auto | Stopped] -- G:\Programme\Motorola Media Link\Lite\NServiceEntry.exe -- (DeviceMonitorService)
SRV - [2011.08.10 21:35:20 | 000,227,184 | ---- | M] () [Auto | Stopped] -- G:\Programme\Motorola\MotoHelper\MotoHelperService.exe -- (MotoHelper)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] --  -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] --  -- (Changer)
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (acg66ihh)
DRV - [2012.07.11 20:07:01 | 000,271,360 | ---- | M] () [Kernel | Auto | Stopped] -- G:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2012.07.11 20:07:00 | 000,018,048 | ---- | M] () [Kernel | Auto | Stopped] -- G:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2011.04.10 15:42:00 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- G:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2010.02.11 09:38:10 | 003,565,056 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- G:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2009.07.10 14:01:06 | 000,025,856 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- G:\WINDOWS\system32\drivers\motoandroid.sys -- (motandroidusb)
DRV - [2009.02.04 04:31:16 | 000,170,496 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- G:\WINDOWS\system32\drivers\atinavt2.sys -- (ATIAVAIW)
DRV - [2006.07.05 14:46:06 | 000,063,352 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- G:\WINDOWS\system32\drivers\sfdrv01a.sys -- (sfdrv01a)
DRV - [2006.06.14 16:56:56 | 000,013,680 | ---- | M] (Protection Technology (StarForce)) [Kernel | Boot | Running] -- G:\WINDOWS\system32\drivers\sfhlp02.sys -- (sfhlp02)
DRV - [2004.08.04 00:10:14 | 000,015,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- G:\WINDOWS\system32\drivers\MPE.sys -- (MPE)
DRV - [2004.08.03 23:14:38 | 000,162,816 | ---- | M] () [Kernel | System | Stopped] -- G:\WINDOWS\system32\drivers\netbt.sys -- (NetBT)
DRV - [2004.08.03 23:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- G:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2004.08.03 22:31:36 | 000,032,768 | ---- | M] (SiS Corporation) [Kernel | On_Demand | Stopped] -- G:\WINDOWS\system32\drivers\sisnic.sys -- (SISNIC)
DRV - [2003.07.18 09:58:20 | 000,036,992 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- G:\WINDOWS\system32\drivers\SISAGPX.SYS -- (sisagp)
DRV - [2002.11.18 16:51:40 | 000,377,358 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Stopped] -- G:\WINDOWS\system32\drivers\cmaudio.sys -- (cmpci)
DRV - [2001.08.18 14:00:00 | 000,038,144 | ---- | M] (HighPoint Technologies, Inc.) [Kernel | Boot | Running] -- G:\WINDOWS\system32\drivers\hpt3xx.sys -- (hpt3xx)
DRV - [2001.08.17 15:02:50 | 000,002,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- G:\WINDOWS\system32\drivers\HIDSwvd.sys -- (HIDSwvd)
DRV - [2001.08.17 15:02:40 | 000,035,200 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- G:\WINDOWS\system32\drivers\msgame.sys -- (msgame)
DRV - [2001.08.17 15:02:32 | 000,008,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- G:\WINDOWS\system32\drivers\hidgame.sys -- (hidgame)
DRV - [2001.08.17 13:50:26 | 000,731,648 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- G:\WINDOWS\system32\drivers\nv4.sys -- (nv4)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-21-329068152-1417001333-725345543-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: G:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_265.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: G:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: G:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: G:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: G:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: G:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: G:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=15.0.1.13: g:\programme\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=15.0.1.13: g:\programme\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpchromebrowserrecordext;version=15.0.1.13: G:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=15.0.1.13: G:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=15.0.1.13: g:\programme\real\realplayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: G:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: G:\Programme\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: G:\Programme\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1: E:\Programme\Mozilla Firefox\plugins\npyaxmpb.dll (Yahoo! Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{9051303c-7e41-4311-a783-d6fe5ef2832d}: G:\Programme\FVD Suite\addons\Firefox\2 [2011.12.05 00:26:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: G:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011.12.18 19:48:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: G:\Programme\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.06.21 19:35:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: E:\Programme\Mozilla Firefox\components [2012.06.26 21:41:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: E:\Programme\Mozilla Firefox\plugins [2012.04.13 12:12:20 | 000,000,000 | ---D | M]
 
[2010.03.10 17:00:26 | 000,002,025 | ---- | M] () -- G:\Programme\mozilla firefox\searchplugins\fcmdSrch.xml
[2011.02.21 16:03:48 | 000,002,046 | ---- | M] () -- G:\Programme\mozilla firefox\searchplugins\fcmdSrchddr.xml
 
O1 HOSTS File: ([2001.08.18 14:00:00 | 000,000,820 | ---- | M]) - G:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - G:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - G:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - G:\Programme\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - G:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Adobe ARM] G:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] G:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] G:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd File not found
O4 - HKLM..\Run: [C-Media Mixer] G:\WINDOWS\mixer.exe (C-Media Electronic Inc. (www.cmedia.com.tw))
O4 - HKLM..\Run: [DivXUpdate] G:\Programme\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [jxksqksfaxywhcz] G:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\jxksqksf.exe ()
O4 - HKLM..\Run: [NvCplDaemon] G:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] G:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] G:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [StartCCC] G:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] G:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [svchospt] G:\WINDOWS\system32\svchospt.exe (FK2)
O4 - HKLM..\Run: [TkBellExe] G:\programme\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [wcmdmgr] G:\WINDOWS\wt\wcmdmgrl.exe (WildTangent, Inc.)
O4 - Startup: G:\Dokumente und Einstellungen\All Users.WINDOWS\Startmenü\Programme\Autostart\Microsoft Office.lnk = E:\Programme\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-329068152-1417001333-725345543-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - %SystemRoot%\system32\wshbth.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - %SystemRoot%\system32\wshbth.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - %SystemRoot%\system32\wshbth.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - %SystemRoot%\system32\wshbth.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - %SystemRoot%\system32\wshbth.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - %SystemRoot%\system32\wshbth.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - %SystemRoot%\system32\wshbth.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - %SystemRoot%\system32\wshbth.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - %SystemRoot%\system32\wshbth.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - %SystemRoot%\system32\wshbth.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - %SystemRoot%\system32\wshbth.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - %SystemRoot%\system32\wshbth.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - %SystemRoot%\system32\wshbth.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - %SystemRoot%\system32\wshbth.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - %SystemRoot%\system32\wshbth.dll File not found
O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - %SystemRoot%\system32\wshbth.dll File not found
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} G:\Programme\Yahoo!\Common\Yinsthelper.dll (Installation Support)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{62002A11-C937-45D5-9E51-66D18DFD57A0}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - G:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - G:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - G:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - G:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (G:\WINDOWS\system32\userinit.exe) - G:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - G:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O32 - HKLM CDRom: AutoRun - 0
O32 - AutoRun File - [2009.10.24 23:13:28 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2001.08.18 14:00:00 | 000,000,112 | R--- | M] () - H:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\SETUP.EXE -- [2001.08.18 14:00:00 | 002,576,384 | R--- | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.31 18:49:07 | 000,597,504 | ---- | C] (OldTimer Tools) -- G:\Dokumente und Einstellungen\Administrator.ASDF-MK16U3WZZC\Desktop\OTL.exe
[2012.07.31 17:44:51 | 000,000,000 | ---D | C] -- G:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\ikeauxanasrvoyu
[2012.07.28 12:51:10 | 000,000,000 | ---D | C] -- G:\Dokumente und Einstellungen\All Users.WINDOWS\Startmenü\Programme\Daydream Software
[2012.07.23 23:28:32 | 000,000,000 | ---D | C] -- G:\Dokumente und Einstellungen\All Users.WINDOWS\Startmenü\Programme\John Deere Busy Days in Deerfield Valley
[2012.07.15 14:29:19 | 000,000,000 | ---D | C] -- G:\Dokumente und Einstellungen\All Users.WINDOWS\Startmenü\Programme\MyPhoneExplorer
[2012.07.11 20:07:14 | 000,000,000 | ---D | C] -- G:\Dokumente und Einstellungen\All Users.WINDOWS\Startmenü\Programme\Anno 1701
[2012.07.10 19:33:34 | 000,036,992 | ---- | C] (Silicon Integrated Systems Corporation) -- G:\WINDOWS\System32\drivers\SISAGPX.SYS
[2012.07.04 22:53:28 | 000,000,000 | ---D | C] -- G:\Programme\Dropbox
[3 G:\WINDOWS\*.tmp files -> G:\WINDOWS\*.tmp -> ]
[1 G:\WINDOWS\System32\*.tmp files -> G:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.31 18:46:38 | 000,002,048 | --S- | M] () -- G:\WINDOWS\bootstat.dat
[2012.07.31 18:42:09 | 000,000,272 | ---- | M] () -- G:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-329068152-1417001333-725345543-1003.job
[2012.07.31 18:42:04 | 000,001,082 | ---- | M] () -- G:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012.07.31 18:42:03 | 000,000,268 | ---- | M] () -- G:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-329068152-1417001333-725345543-1005.job
[2012.07.31 18:42:03 | 000,000,268 | ---- | M] () -- G:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-329068152-1417001333-725345543-1004.job
[2012.07.31 17:44:56 | 000,000,051 | ---- | M] () -- G:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\lcarncyssjawnzc
[2012.07.31 17:44:33 | 000,061,440 | ---- | M] () -- G:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\jxksqksf.exe
[2012.07.30 23:07:02 | 000,001,086 | ---- | M] () -- G:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012.07.30 19:39:00 | 000,000,280 | ---- | M] () -- G:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-329068152-1417001333-725345543-1003.job
[2012.07.27 18:50:55 | 000,002,262 | ---- | M] () -- G:\WINDOWS\System32\wpa.dbl
[2012.07.23 23:28:33 | 000,000,755 | ---- | M] () -- G:\Dokumente und Einstellungen\All Users.WINDOWS\Desktop\John Deere Busy Days in Deerfield Valley.lnk
[2012.07.23 20:06:26 | 000,001,984 | ---- | M] () -- G:\WINDOWS\System32\d3d9caps.dat
[2012.07.21 13:12:58 | 000,020,480 | ---- | M] () -- G:\WINDOWS\System32\H@tKeysH@@k.DLL
[2012.07.15 14:29:19 | 000,000,828 | ---- | M] () -- G:\Dokumente und Einstellungen\All Users.WINDOWS\Desktop\MyPhoneExplorer.lnk
[2012.07.12 19:18:40 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- G:\WINDOWS\System32\FlashPlayerApp.exe
[2012.07.12 19:18:39 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- G:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012.07.11 20:07:01 | 000,271,360 | ---- | M] () -- G:\WINDOWS\System32\drivers\atksgt.sys
[2012.07.11 20:07:00 | 000,018,048 | ---- | M] () -- G:\WINDOWS\System32\drivers\lirsgt.sys
[3 G:\WINDOWS\*.tmp files -> G:\WINDOWS\*.tmp -> ]
[1 G:\WINDOWS\System32\*.tmp files -> G:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.31 17:44:55 | 000,061,440 | ---- | C] () -- G:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\jxksqksf.exe
[2012.07.31 17:44:39 | 000,000,051 | ---- | C] () -- G:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\lcarncyssjawnzc
[2012.07.23 23:28:33 | 000,000,755 | ---- | C] () -- G:\Dokumente und Einstellungen\All Users.WINDOWS\Desktop\John Deere Busy Days in Deerfield Valley.lnk
[2012.07.21 13:12:58 | 000,020,480 | ---- | C] () -- G:\WINDOWS\System32\H@tKeysH@@k.DLL
[2012.07.15 14:29:19 | 000,000,828 | ---- | C] () -- G:\Dokumente und Einstellungen\All Users.WINDOWS\Desktop\MyPhoneExplorer.lnk
[2012.07.11 20:07:01 | 000,271,360 | ---- | C] () -- G:\WINDOWS\System32\drivers\atksgt.sys
[2012.07.11 20:07:00 | 000,018,048 | ---- | C] () -- G:\WINDOWS\System32\drivers\lirsgt.sys
[2012.04.21 13:39:10 | 000,032,768 | ---- | C] () -- G:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2012.02.24 20:37:13 | 000,192,512 | ---- | C] () -- G:\WINDOWS\System32\srkey.exe
[2012.02.22 22:19:13 | 000,101,888 | ---- | C] () -- G:\WINDOWS\System32\VB6STKIT.DLL
[2012.02.22 22:19:13 | 000,010,752 | ---- | C] () -- G:\WINDOWS\System32\hh.exe
[2012.02.05 01:03:52 | 000,004,938 | ---- | C] () -- G:\Dokumente und Einstellungen\All Users.WINDOWS\Anwendungsdaten\cegybigw.pob
[2012.02.01 18:34:12 | 000,363,520 | ---- | C] () -- G:\WINDOWS\System32\PsisDecd.dll
[2012.01.31 19:34:22 | 000,000,000 | ---- | C] () -- G:\WINDOWS\ativpsrm.bin
[2012.01.31 19:28:49 | 000,593,920 | ---- | C] () -- G:\WINDOWS\System32\ati2sgag.exe
[2012.01.13 18:52:51 | 000,146,944 | ---- | C] () -- G:\WINDOWS\UnGins.exe
[2012.01.11 22:28:08 | 000,000,025 | ---- | C] () -- G:\WINDOWS\mixerdef.ini
[2012.01.01 22:21:32 | 000,000,069 | ---- | C] () -- G:\WINDOWS\NeroDigital.ini
[2011.12.27 12:30:10 | 000,192,512 | ---- | C] () -- G:\WINDOWS\System32\fgkey.exe
[2011.12.18 13:16:22 | 000,000,200 | ---- | C] () -- G:\WINDOWS\cncscore.ini
[2011.12.07 19:09:49 | 000,107,520 | RHS- | C] () -- G:\WINDOWS\System32\TAKDSDecoder.dll
[2011.12.05 23:04:00 | 000,059,904 | ---- | C] () -- G:\WINDOWS\System32\OpenVideo.dll
[2011.12.05 23:03:52 | 000,054,784 | ---- | C] () -- G:\WINDOWS\System32\OVDecode.dll
[2011.11.25 21:10:53 | 001,456,640 | ---- | C] () -- G:\Programme\Gemeinsame Dateien\Falk Navi-Manager.msi
[2011.05.12 22:48:39 | 000,032,256 | ---- | C] () -- G:\WINDOWS\System32\AVSredirect.dll
[2011.05.12 22:37:13 | 000,000,046 | ---- | C] () -- G:\WINDOWS\Speed.INI
[2011.05.03 00:33:27 | 000,001,984 | ---- | C] () -- G:\WINDOWS\System32\d3d9caps.dat
[2011.04.28 21:09:05 | 000,000,403 | ---- | C] () -- G:\WINDOWS\ODBC.INI
[2011.04.10 16:24:25 | 000,544,256 | ---- | C] () -- G:\WINDOWS\System32\janGraphics.dll
[2011.04.10 16:24:25 | 000,124,416 | ---- | C] () -- G:\WINDOWS\System32\dXCtrls.dll
[2011.04.10 01:09:21 | 000,095,232 | ---- | C] () -- G:\WINDOWS\System32\SMACKW32.DLL
[2011.04.10 01:09:21 | 000,056,832 | ---- | C] () -- G:\WINDOWS\System32\iyvu9_32.dll
[2011.04.09 23:10:07 | 000,004,161 | ---- | C] () -- G:\WINDOWS\ODBCINST.INI
[2011.04.09 23:07:57 | 000,195,368 | ---- | C] () -- G:\WINDOWS\System32\FNTCACHE.DAT
[2011.04.09 22:35:12 | 000,000,000 | ---- | C] () -- G:\WINDOWS\nsreg.dat
[2011.04.09 22:26:55 | 000,002,048 | --S- | C] () -- G:\WINDOWS\bootstat.dat
[2011.04.09 22:19:59 | 000,021,740 | ---- | C] () -- G:\WINDOWS\System32\emptyregdb.dat
[2009.01.30 01:40:21 | 000,155,648 | ---- | C] () -- G:\Programme\JnG.exe
 
========== Hard Links - Junction Points - Mount Points - Symbolic Links ==========
[G:\WINDOWS\$NtUninstallKB9970$] -> Error: Cannot create file handle -> Unknown point type

< End of report >

--- --- ---

OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 31.07.2012 18:49:23 - Run 1
OTL by OldTimer - Version 3.2.55.0     Folder = G:\Dokumente und Einstellungen\Administrator.ASDF-MK16U3WZZC\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,76 Gb Available Physical Memory | 88,06% Memory free
3,71 Gb Paging File | 3,65 Gb Available in Paging File | 98,50% Paging File free
Paging file location(s): F:\pagefile.sys 1900 1900 [binary data]
 
%SystemDrive% = G: | %SystemRoot% = G:\WINDOWS | %ProgramFiles% = G:\Programme
Drive C: | 10,41 Gb Total Space | 6,61 Gb Free Space | 63,47% Space Free | Partition Type: NTFS
Drive D: | 57,26 Gb Total Space | 5,71 Gb Free Space | 9,97% Space Free | Partition Type: NTFS
Drive E: | 57,26 Gb Total Space | 7,45 Gb Free Space | 13,02% Space Free | Partition Type: NTFS
Drive F: | 2,17 Gb Total Space | 0,30 Gb Free Space | 13,65% Space Free | Partition Type: NTFS
Drive G: | 59,01 Gb Total Space | 5,10 Gb Free Space | 8,64% Space Free | Partition Type: NTFS
Drive H: | 501,02 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive J: | 121,53 Mb Total Space | 118,24 Mb Free Space | 97,29% Space Free | Partition Type: FAT32
 
Computer Name: ASDF-MK16U3WZZC | User Name: Administrator | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Opera.HTML] -- G:\Programme\Opera\Opera.exe (Opera Software)
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "G:\Programme\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "G:\Programme\Opera\Opera.exe" "%1" (Opera Software)
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
========== Authorized Applications List ==========
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{03ADC8AB-C130-0C3D-1FF9-2C385DF25689}" = CCC Help Czech
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{07021185-008D-ABF9-7716-475AC035F8B3}" = CCC Help Spanish
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0F8D0406-7755-AC37-6529-73AD649DBE32}" = Catalyst Control Center Graphics Previews Common
"{1545207E-C6F3-31D7-9918-BDBB65075FBF}" = Microsoft .NET Framework 3.5 Language Pack - deu
"{1D76A52C-87A6-4AB0-A7B0-08C8D5DF1D75}" = Motorola Mobile Drivers Installation 5.2.0
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{22072CC8-7230-96F8-52F4-05EAF3F906B6}" = CCC Help Polish
"{2368ADBD-6FDF-4B9F-FE41-E20B4D78E79E}" = CCC Help Chinese Standard
"{25EF0DC4-B072-2E04-4581-A13C91423CE6}" = CCC Help Portuguese
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{26F7855C-443B-00A6-F7B8-A97A5403F617}" = CCC Help Danish
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{2B653229-9854-4989-B780-D978F5F13EAB}" = FEAR
"{2CB4A925-48A7-DA65-DCEE-D4DE224B7D84}" = CCC Help English
"{306D75B9-7FFF-FF65-0C76-57F2FE4FE1D6}" = Catalyst Control Center Core Implementation
"{32B12FE4-5A51-751A-1FB6-A14E97EBDD5C}" = CCC Help German
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{351512E5-01BD-E878-6F57-AA3E517D9ECE}" = Skins
"{354A387E-0374-21A3-6832-335674A6D7D1}" = CCC Help French
"{378397D6-FD32-4092-A854-6A75CB7EDA46}" = MOTOROLA MEDIA LINK
"{3C00BEE9-26D0-D9E0-A2D1-62F70D412A12}" = CCC Help Turkish
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4346F7AA-3D56-0941-424C-4454E04D37F6}" = CCC Help Italian
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CAE2F2C-75CD-A0DE-7520-449BCBBCC833}" = CCC Help Korean
"{5741E9DB-5BE4-4446-9D03-E5F228ACC920}" = MAGIX Speed burnR (MSI)
"{57F7F0A5-8F22-8E63-E819-803B5C9CA3A5}" = CCC Help Dutch
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{5EA437D2-7A57-B60E-E8F2-76BFAC0895A5}" = CCC Help Chinese Traditional
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{61AF4E75-050E-0304-3417-8BC16417FEB1}" = CCC Help Greek
"{632005DA-C291-5275-284C-5EE96B05C714}" = Catalyst Control Center HydraVision Full
"{6C72BE0C-3E25-CACD-0070-2FD9C02ABA14}" = ccc-core-preinstall
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{74224F8D-4A17-4816-9EDB-7BB854DE532C}" = NVIDIA PhysX v8.04.25
"{76344EF7-F429-4D8D-B373-1C99753A4C82}_is1" = John Deere Busy Days in Deerfield Valley Version 1.0
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{80E4B2D6-BFF2-402C-96C4-3942DF24CABB}_is1" = FVD Suite 2.6.9
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{880BB617-914E-17E8-D877-A96BAC5794D2}" = Catalyst Control Center Graphics Full New
"{8897CF22-DB6C-8248-895C-12BFA2677F51}" = CCC Help Hungarian
"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs
"{8D7133DE-27D2-47E5-B248-4180278D32AA}" = Catalyst Control Center - Branding
"{8FACF524-6898-4C83-904F-7E8FB656AB89}" = Lock On: Modern Air Combat Demo
"{91473F13-F4E2-4140-9AD7-F3657C68D1A9}" = MAGIX Video easy HD Download-Version
"{9309DD7E-EBFE-3C95-8B47-30D3A012F606}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{94CAC2F1-C856-47F4-AF24-65A1E75AEDB9}" = MotoHelper MergeModules
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9F5C1ED8-F249-45D4-84FA-D88F813F9651}" = MAGIX Screenshare
"{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{AF710FDE-2815-8C8D-5281-8004C2654AA6}" = CCC Help Russian
"{AFF2D965-C6F2-A210-FBF7-532612AA1D23}" = CCC Help Swedish
"{B21336EE-4AEF-9940-4AC7-EDB89854B8D3}" = CCC Help Thai
"{B93DCF58-AA57-41EC-8D69-B05C66C6312D}_is1" = SUPER © v2011.build.49 (July 1st, 2011) Version v2011.build.49
"{BA7632CD-454A-11D5-B5D0-0010B543C735}" = Leadfoot
"{BB394D95-C049-4EA4-00B3-F866A3357CCD}" = F1 2002 WORK IN PROGRESS DEMO
"{BBA69346-61A1-BD34-E75A-4D81232DB1FE}" = Catalyst Control Center Localization All
"{BFD5ED08-F066-92D5-BE67-3B9AE5DCFF0C}" = CCC Help Japanese
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4186C0D-FB9F-5D83-21FB-A737A13EFAE6}" = AMD Catalyst Install Manager
"{C4609F15-FB3C-D97E-BAA1-4F10815039C2}" = Catalyst Control Center Graphics Full Existing
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D01FAC3D-86B4-3A19-9D10-9156A0EB3EBE}" = CCC Help Finnish
"{D73722C8-3F65-C75B-A631-5D36894DAB92}" = ccc-core-static
"{DDAD33B6-8C00-428D-087B-A7088355B9BE}" = Catalyst Control Center Graphics Light
"{DF8195AF-8E6F-4487-A0EE-196F7E3F4B8A}" = jetAudio Basic VX
"{E333F074-FC7F-596D-3D61-44F0EC28E8C0}" = ccc-utility
"{E5514B56-843E-4237-9E8B-E0EC01A204AA}" = Race Driver Demo
"{E90DCEE9-DC27-401B-A7AC-B0AFF5B34E4D}" = Lock On: Modern Air Combat
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FA38F9E4-BED7-E021-B660-8FDFF7EC6E1A}" = CCC Help Norwegian
"{FB13DAB7-58CC-44DA-B56E-4BF1F7276E2A}" = Super 1 Karting Demo
"4x4 Evolution Demo" = 4x4 Evolution Demo
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"ATI Display Driver" = ATI Display Driver
"Big Scale Racing Demo_is1" = Big Scale Racing Demo
"Clusterball 1.003 Base Version" = Clusterball 1.003 Base Version
"Defraggler" = Defraggler
"DivX Setup" = DivX-Setup
"Ducati Demo" = Ducati Demo
"Extreme Speedway Demo" = Extreme Speedway Demo
"Falcon 4.0" = Falcon 4.0
"FLV Player" = FLV Player 2.0 (build 25)
"GameSpy Arcade" = GameSpy Arcade
"Grey Olltwit's Demolition Dumpout" = Grey Olltwit's Demolition Dumpout
"Halo" = Microsoft Halo
"InstallShield_{E5514B56-843E-4237-9E8B-E0EC01A204AA}" = Race Driver Demo
"LEGO Racers" = LEGO Racers
"Lock On - Flaming Cliffs" = Lock On - Flaming Cliffs
"Lock On 1.1" = Lock On 1.1
"MAGIX_MSI_Video_easy_2" = MAGIX Video easy HD Download-Version
"Microsoft .NET Framework 3.5 Language Pack - deu" = Microsoft .NET Framework 3.5 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Monster Truck Madness 2.0" = Microsoft Monster Truck Madness 2
"Moonshine Runners Demo" = Moonshine Runners Demo
"Motocross Madness 2" = Microsoft Motocross Madness 2
"Motocross Stunt Racer Demo" = Motocross Stunt Racer Demo
"MotoHelper" = MotoHelper 2.0.53 Driver 5.2.0
"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MPE" = MyPhoneExplorer
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NVIDIA Drivers" = NVIDIA Drivers
"Opera 12.00.1467" = Opera 12.00
"PCI Audio Driver" = PCI Audio Driver
"RealPlayer 15.0" = RealPlayer
"ST6UNST #1" = GEPath 1.4.6
"Steam App 90200" = Farming Simulator 2011
"Test Drive 6 Demo" = Test Drive 6 Demo
"TmNationsForever_is1" = TmNationsForever
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 2
"WinGimp-2.0_is1" = GIMP 2.4.7
"WinGTK-2_is1" = GTK+ 2.10.13 runtime environment
"WinRAR archiver" = WinRAR 4.01 (32-Bit)
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"XviD" = XviD MPEG-4 Codec
"YInstHelper" = Yahoo! Install Manager
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 15.07.2012 08:30:54 | Computer Name = ASDF-MK16U3WZZC | Source = MsiInstaller | ID = 11706
Description = Produkt: Microsoft Office 2000 Premium -- Fehler 1706. Es wurde keine
 gültige Quelle für das Produkt "Microsoft Office 2000 Premium" gefunden. Die Installation
 kann nicht fortgesetzt werden.
 
Error - 15.07.2012 08:57:00 | Computer Name = ASDF-MK16U3WZZC | Source = MsiInstaller | ID = 11706
Description = Produkt: Microsoft Office 2000 Premium -- Fehler 1706. Es wurde keine
 gültige Quelle für das Produkt "Microsoft Office 2000 Premium" gefunden. Die Installation
 kann nicht fortgesetzt werden.
 
Error - 15.07.2012 08:57:14 | Computer Name = ASDF-MK16U3WZZC | Source = MsiInstaller | ID = 11706
Description = Produkt: Microsoft Office 2000 Premium -- Fehler 1706. Es wurde keine
 gültige Quelle für das Produkt "Microsoft Office 2000 Premium" gefunden. Die Installation
 kann nicht fortgesetzt werden.
 
Error - 18.07.2012 12:19:08 | Computer Name = ASDF-MK16U3WZZC | Source = MsiInstaller | ID = 11706
Description = Produkt: Microsoft Office 2000 Premium -- Fehler 1706. Es wurde keine
 gültige Quelle für das Produkt "Microsoft Office 2000 Premium" gefunden. Die Installation
 kann nicht fortgesetzt werden.
 
Error - 18.07.2012 12:20:01 | Computer Name = ASDF-MK16U3WZZC | Source = MsiInstaller | ID = 11706
Description = Produkt: Microsoft Office 2000 Premium -- Fehler 1706. Es wurde keine
 gültige Quelle für das Produkt "Microsoft Office 2000 Premium" gefunden. Die Installation
 kann nicht fortgesetzt werden.
 
Error - 19.07.2012 15:47:19 | Computer Name = ASDF-MK16U3WZZC | Source = MsiInstaller | ID = 11706
Description = Produkt: Microsoft Office 2000 Premium -- Fehler 1706. Es wurde keine
 gültige Quelle für das Produkt "Microsoft Office 2000 Premium" gefunden. Die Installation
 kann nicht fortgesetzt werden.
 
Error - 19.07.2012 15:47:33 | Computer Name = ASDF-MK16U3WZZC | Source = MsiInstaller | ID = 11706
Description = Produkt: Microsoft Office 2000 Premium -- Fehler 1706. Es wurde keine
 gültige Quelle für das Produkt "Microsoft Office 2000 Premium" gefunden. Die Installation
 kann nicht fortgesetzt werden.
 
Error - 19.07.2012 15:49:31 | Computer Name = ASDF-MK16U3WZZC | Source = MsiInstaller | ID = 11706
Description = Produkt: Microsoft Office 2000 Premium -- Fehler 1706. Es wurde keine
 gültige Quelle für das Produkt "Microsoft Office 2000 Premium" gefunden. Die Installation
 kann nicht fortgesetzt werden.
 
Error - 19.07.2012 15:51:38 | Computer Name = ASDF-MK16U3WZZC | Source = MsiInstaller | ID = 11706
Description = Produkt: Microsoft Office 2000 Premium -- Fehler 1706. Es wurde keine
 gültige Quelle für das Produkt "Microsoft Office 2000 Premium" gefunden. Die Installation
 kann nicht fortgesetzt werden.
 
Error - 21.07.2012 06:31:33 | Computer Name = ASDF-MK16U3WZZC | Source = MsiInstaller | ID = 11706
Description = Produkt: Microsoft Office 2000 Premium -- Fehler 1706. Es wurde keine
 gültige Quelle für das Produkt "Microsoft Office 2000 Premium" gefunden. Die Installation
 kann nicht fortgesetzt werden.
 
[ System Events ]
Error - 31.07.2012 12:42:56 | Computer Name = ASDF-MK16U3WZZC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Druckwarteschlange" wurde unerwartet beendet. Dies ist
 bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden
 durchgeführt: Starten Sie den Dienst neu..
 
Error - 31.07.2012 12:47:35 | Computer Name = ASDF-MK16U3WZZC | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {1BE1F766-5536-11D1-B726-00C04FB926AF}
 
Error - 31.07.2012 12:47:56 | Computer Name = ASDF-MK16U3WZZC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "DHCP-Client" ist vom Dienst "NetBios über TCP/IP" abhängig,
 der aufgrund folgenden Fehlers nicht gestartet wurde:   %%31
 
Error - 31.07.2012 12:47:56 | Computer Name = ASDF-MK16U3WZZC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "DNS-Client" ist vom Dienst "TCP/IP-Protokolltreiber" abhängig,
 der aufgrund folgenden Fehlers nicht gestartet wurde:   %%31
 
Error - 31.07.2012 12:47:56 | Computer Name = ASDF-MK16U3WZZC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "TCP/IP-NetBIOS-Hilfsprogramm" ist vom Dienst "Umgebung
 für die AFD-Netzwerkunterstützung" abhängig, der aufgrund folgenden Fehlers nicht
 gestartet wurde:   %%31
 
Error - 31.07.2012 12:47:56 | Computer Name = ASDF-MK16U3WZZC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "IPSEC-Dienste" ist vom Dienst "IPSEC-Treiber" abhängig,
 der aufgrund folgenden Fehlers nicht gestartet wurde:   %%31
 
Error - 31.07.2012 12:47:56 | Computer Name = ASDF-MK16U3WZZC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
   AFD  Fips  intelppm  IPSec  MRxSmb  NetBIOS  NetBT  RasAcd  Rdbss  Tcpip
 
Error - 31.07.2012 12:48:21 | Computer Name = ASDF-MK16U3WZZC | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}
 
Error - 31.07.2012 12:48:34 | Computer Name = ASDF-MK16U3WZZC | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}
 
Error - 31.07.2012 12:48:54 | Computer Name = ASDF-MK16U3WZZC | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
 mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}
 
 
< End of report >

--- --- ---

Könnt ihr mir bitte sagen, wie ich nun weiter vorgehen muss, um den Trojaner los zu werden?

Danke schon mal soweit.

t'john · 31.07.2012, 18:39

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

2. Schritt

Systemscan mit OTL (bebilderte Anleitung)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe
- Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
- Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
- Unter Extra Registry, wähle bitte Use SafeList
- Klicke nun auf Run Scan links oben
- Wenn der Scan beendet wurde werden 2 Logfiles erstellt
- Poste die Logfiles hier in den Thread.

t'john · 21.08.2012, 03:39

Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.

BundesPolizei Trojaner auf dem PC

Log-Analyse und Auswertung: BundesPolizei Trojaner auf dem PC