| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: laptop von der österreichischen polizei gesperrt!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
22.05.2013, 20:14
| #16 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  laptop von der österreichischen polizei gesperrt! Nicht irgendeinen Windows-Ordner, du musst den Windows-Ordner deiner Windows-Installation nehmen - steht das nicht in der Anleitung?!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
26.05.2013, 08:20
| #17 |
 | laptop von der österreichischen polizei gesperrt! Bei mir wurde aber nur OTL.txt erstellt. Wie erstellt man EXTRAS.txt?
__________________Hier jedenfalls mal das OTL.txt:OTL Logfile: Code:
ATTFilter OTL logfile created on: 5/26/2013 3:21:32 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 75.27 Mb Free Space | 75.28% Space Free | Partition Type: NTFS
Drive E: | 546.25 Gb Total Space | 481.89 Gb Free Space | 88.22% Space Free | Partition Type: NTFS
Drive F: | 48.83 Gb Total Space | 6.77 Gb Free Space | 13.87% Space Free | Partition Type: NTFS
Drive G: | 7.45 Gb Total Space | 7.45 Gb Free Space | 100.00% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
========== Win32 Services (SafeList) ==========
SRV:64bit: - [2010/09/22 21:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/03/14 12:13:28 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- E:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/14 10:05:23 | 002,469,992 | ---- | M] () [Auto] -- E:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe -- (BrowserProtect)
SRV - [2011/10/01 03:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 03:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/07/31 13:09:14 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- E:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/05/10 08:56:47 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- E:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/03/18 16:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/03 23:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto] -- E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2009/12/10 02:48:26 | 002,320,920 | ---- | M] (Intel Corporation) [Auto] -- E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2009/12/10 02:48:24 | 000,268,824 | ---- | M] (Intel Corporation) [Auto] -- E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009/11/07 06:46:52 | 000,020,480 | ---- | M] (X10) [Auto] -- E:\Program Files (x86)\Common Files\X10\Common\X10nets.exe -- (x10nets)
SRV - [2009/10/22 20:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) [On_Demand] -- E:\Program Files (x86)\Launch Manager\WisLMSvc.exe -- (WisLMSvc)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007/07/24 06:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- E:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2011/10/01 03:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011/10/01 03:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011/10/01 03:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand] -- E:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011/10/01 03:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011/07/31 13:09:14 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System] -- E:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011/07/31 13:09:14 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto] -- E:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2010/09/30 07:00:06 | 000,180,736 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010/09/30 07:00:06 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010/08/25 14:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010/06/21 09:15:54 | 000,287,232 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010/06/09 08:00:50 | 001,887,528 | ---- | M] (Trident Microsystems, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\TrdCap64.sys -- (TrdCap64)
DRV:64bit: - [2010/05/24 09:46:36 | 000,246,304 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- E:\Windows\System32\Drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010/03/04 11:53:02 | 000,075,816 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2010/03/02 07:25:26 | 001,098,784 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand] -- E:\Windows\System32\drivers\rtl8192se.sys -- (rtl8192se)
DRV:64bit: - [2010/02/26 23:02:12 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\Impcd.sys -- (Impcd)
DRV:64bit: - [2010/02/22 04:09:10 | 000,011,776 | ---- | M] (MBB Incorporated) [Kernel | On_Demand] -- E:\Windows\System32\drivers\massfilter.sys -- (massfilter)
DRV:64bit: - [2010/02/04 07:54:32 | 001,888,864 | ---- | M] (NXP Semiconductors Germany GmbH) [Kernel | On_Demand] -- E:\Windows\System32\drivers\NxpCap64.sys -- (NxpCap64)
DRV:64bit: - [2009/10/12 10:23:22 | 000,114,304 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ewusbdev.sys -- (hwusbdev)
DRV:64bit: - [2009/09/24 05:52:34 | 000,913,888 | ---- | M] (DiBcom SA) [Kernel | On_Demand] -- E:\Windows\System32\drivers\mod77-64.sys -- (mod7764)
DRV:64bit: - [2009/09/17 22:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- E:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:35:42 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/05/13 15:47:44 | 000,032,792 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\Drivers\x10ufx2.sys -- (XUIF)
DRV:64bit: - [2009/05/13 15:26:14 | 000,015,896 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\Drivers\x10hid.sys -- (X10Hid)
DRV:64bit: - [2007/07/11 05:09:56 | 000,112,512 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Florian_ON_E\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = Google
IE - HKU\Florian_ON_E\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI
IE - HKU\Florian_ON_E\Software\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\Florian_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKU\Florian_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\LocalService_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\System32\Macromed\Flash\NPSWF64_11_6_602_180.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: E:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer: E:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: E:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE: File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: E:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: E:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: E:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{58bd07eb-0ee0-4df0-8121-dc9b693373df}: C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension [2012/12/28 13:30:26 | 000,000,000 | ---D | M]
[2012/10/01 09:06:58 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Florian\AppData\Roaming\Mozilla\Extensions
[2012/10/01 09:06:58 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Florian\AppData\Roaming\Mozilla\Extensions\{SbX-155247-9783706842167-stu10}
[2012/12/28 13:30:17 | 000,000,000 | ---D | M] (No name found) -- E:\Program Files (x86)\Mozilla Firefox\extensions
O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - E:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (DataMngr) - {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} - E:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\BrowserConnection.dll (Bandoo Media Inc)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - E:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.8.7.2\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (DataMngr) - {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} - E:\Program Files (x86)\Search Results Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media Inc)
O2 - BHO: (Search-Results Toolbar) - {f34c9277-6577-4dff-b2d7-7d58092f272f} - E:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - E:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.8.7.2\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {f34c9277-6577-4dff-b2d7-7d58092f272f} - E:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4:64bit: - HKLM..\Run: [RtHDVBg] E:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] E:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] E:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DATAMNGR] E:\Program Files (x86)\Search Results Toolbar\Datamngr\datamngrUI.exe (Bandoo Media Inc)
O4 - HKLM..\Run: [HotkeyApp] E:\Program Files (x86)\Launch Manager\HotkeyApp.exe (Wistron)
O4 - HKLM..\Run: [LMgrOSD] File not found
O4 - HKLM..\Run: [LMgrVolOSD] E:\Program Files (x86)\Launch Manager\OSD.exe (Wistron Corp.)
O4 - HKLM..\Run: [NUSB3MON] E:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [Wbutton] E:\Program Files (x86)\Launch Manager\Wbutton.exe (Wistron Corp.)
O4 - HKU\LocalService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_E..\RunOnce: [mctadmin] File not found
O4 - HKU\NetworkService_ON_E..\RunOnce: [mctadmin] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra Button: eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found
O9:64bit: - Extra 'Tools' menuitem : eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found
O9 - Extra Button: eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found
O9 - Extra 'Tools' menuitem : eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} hxxp://91.113.220.122/activex/AMC.cab (AxisMediaControlEmb Class)
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll) - E:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\datamngr.dll (Bandoo Media Inc)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll) - E:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\IEBHO.dll (Bandoo Media Inc)
O20 - AppInit_DLLs: (c:\progra~3\browse~1\251005~1.80\{c16c1~1\browse~1.dll) - E:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKU\Florian_ON_E Winlogon: Shell - (explorer.exe) - E:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKU\Florian_ON_E Winlogon: Shell - (C:\Users\Florian\AppData\Roaming\skype.dat) - E:\Users\Florian\AppData\Roaming\skype.dat ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{15c05717-a038-11e1-9e5c-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15c05717-a038-11e1-9e5c-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{15c05720-a038-11e1-9e5c-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15c05720-a038-11e1-9e5c-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{15ef4256-47f5-11e0-9dd5-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15ef4256-47f5-11e0-9dd5-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{15ef4265-47f5-11e0-9dd5-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15ef4265-47f5-11e0-9dd5-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{15ef4267-47f5-11e0-9dd5-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15ef4267-47f5-11e0-9dd5-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{17f17a45-50b9-11e0-aac0-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{17f17a45-50b9-11e0-aac0-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{17f17a53-50b9-11e0-aac0-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{17f17a53-50b9-11e0-aac0-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{4d9a9eba-2524-11e0-8f53-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{4d9a9eba-2524-11e0-8f53-806e6f6e6963}\Shell\AutoRun\command - "" = E:\cdstart.exe
O33 - MountPoints2\{552b7940-47f9-11e0-8eb8-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{552b7940-47f9-11e0-8eb8-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{552b7942-47f9-11e0-8eb8-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{552b7942-47f9-11e0-8eb8-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{6e7e3b9c-523d-11e0-a8ca-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{6e7e3b9c-523d-11e0-a8ca-485d60465352}\Shell\AutoRun\command - "" = H:\AutoRun.exe
O33 - MountPoints2\{79b6d9a4-b7be-11e1-91ad-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{79b6d9a4-b7be-11e1-91ad-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{84ebdeae-ddac-11e1-aa4b-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{84ebdeae-ddac-11e1-aa4b-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{962c8a44-e2da-11e0-a52c-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{962c8a44-e2da-11e0-a52c-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{983e8907-4dd5-11e2-a5c5-00262dc3534e}\Shell - "" = AutoRun
O33 - MountPoints2\{983e8907-4dd5-11e2-a5c5-00262dc3534e}\Shell\AutoRun\command - "" = E:\cdstart.exe
O33 - MountPoints2\{c04b7e29-bec5-11e1-914e-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{c04b7e29-bec5-11e1-914e-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{c04b7e2b-bec5-11e1-914e-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{c04b7e2b-bec5-11e1-914e-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{e566942f-da2c-11e0-a997-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{e566942f-da2c-11e0-a997-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{ebb4f2fe-70c4-11e0-a6ee-001e101f2500}\Shell - "" = AutoRun
O33 - MountPoints2\{ebb4f2fe-70c4-11e0-a6ee-001e101f2500}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{fdc9e9cd-dadb-11e0-a6c8-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{fdc9e9cd-dadb-11e0-a6c8-485d60465352}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[1 E:\Windows\*.tmp files -> E:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013/05/11 04:40:08 | 000,067,584 | --S- | M] () -- E:\Windows\bootstat.dat
[2013/05/11 04:40:04 | 000,001,110 | ---- | M] () -- E:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/11 04:40:03 | 000,000,884 | ---- | M] () -- E:\Windows\tasks\Adobe Flash Player Updater.job
[2013/05/11 04:39:15 | 000,654,852 | ---- | M] () -- E:\Windows\System32\perfh007.dat
[2013/05/11 04:39:15 | 000,616,694 | ---- | M] () -- E:\Windows\System32\perfh009.dat
[2013/05/11 04:39:15 | 000,130,434 | ---- | M] () -- E:\Windows\System32\perfc007.dat
[2013/05/11 04:39:15 | 000,106,816 | ---- | M] () -- E:\Windows\System32\perfc009.dat
[2013/05/11 04:38:23 | 000,000,004 | ---- | M] () -- E:\Users\Florian\AppData\Roaming\skype.ini
[2013/05/11 03:31:16 | 000,001,106 | ---- | M] () -- E:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/11 03:30:21 | 3061,960,704 | -HS- | M] () -- E:\hiberfil.sys
[2013/05/06 11:38:34 | 000,010,096 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/06 11:38:34 | 000,010,096 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/05 09:10:47 | 322,613,881 | ---- | M] () -- E:\Windows\MEMORY.DMP
[2013/04/30 16:12:31 | 000,000,374 | ---- | M] () -- E:\Windows\System32\drivers\etc\hosts.ics
[1 E:\Windows\*.tmp files -> E:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013/05/04 18:12:45 | 000,000,004 | ---- | C] () -- E:\Users\Florian\AppData\Roaming\skype.ini
[2012/03/16 10:07:40 | 000,102,400 | ---- | C] () -- E:\Users\Florian\AppData\Roaming\skype.dat
[2011/03/17 13:30:31 | 000,000,400 | ---- | C] () -- E:\Windows\ODBC.INI
[2011/03/16 10:25:13 | 001,527,912 | ---- | C] () -- E:\Windows\SysWow64\PerfStringBackup.INI
[2010/11/03 13:47:42 | 000,000,000 | ---- | C] () -- E:\Windows\Bench32.INI
[2010/11/02 13:04:22 | 000,127,184 | ---- | C] () -- E:\Windows\Unwise.exe
[2010/11/02 13:04:21 | 000,149,504 | ---- | C] () -- E:\Windows\unwise32_setup.exe
[2010/11/02 12:49:13 | 000,451,072 | ---- | C] () -- E:\Windows\SysWow64\ISSRemoveSP.exe
[2010/11/02 12:10:54 | 000,870,560 | ---- | C] () -- E:\Windows\SysWow64\igkrng575.bin
[2010/11/02 12:10:54 | 000,208,896 | ---- | C] () -- E:\Windows\SysWow64\iglhsip32.dll
[2010/11/02 12:10:54 | 000,143,360 | ---- | C] () -- E:\Windows\SysWow64\iglhcp32.dll
[2010/11/02 12:10:54 | 000,104,796 | ---- | C] () -- E:\Windows\SysWow64\igfcg575m.bin
[2010/11/02 12:10:52 | 000,127,868 | ---- | C] () -- E:\Windows\SysWow64\igcompkrng575.bin
[2010/06/08 09:19:24 | 000,692,224 | ---- | C] () -- E:\Windows\SysWow64\libeay32.dll
[2010/06/08 09:19:24 | 000,151,552 | ---- | C] () -- E:\Windows\SysWow64\ssleay32.dll
[2010/04/20 10:31:43 | 000,936,832 | ---- | C] () -- E:\Windows\SysWow64\M2ElevatedCalls.dll
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- E:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- E:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- E:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- E:\Windows\mib.bin
[2009/07/13 20:02:54 | 000,245,248 | ---- | C] () -- E:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- E:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- E:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- E:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- E:\Windows\SysWow64\mlang.dat
[2008/10/07 04:13:30 | 000,197,912 | ---- | C] () -- E:\Windows\SysWow64\physxcudart_20.dll
[2008/10/07 04:13:22 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSwedish.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSpanish.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelPortugese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelKorean.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelJapanese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelGerman.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelFrench.dll
[2003/02/20 12:53:42 | 000,005,702 | ---- | C] () -- E:\Windows\SysWow64\OUTLPERF.INI
========== LOP Check ==========
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Application Data
[2012/12/28 13:30:02 | 000,000,000 | ---D | M] -- E:\ProgramData\Babylon
[2012/12/02 02:34:48 | 000,000,000 | ---D | M] -- E:\ProgramData\boost_interprocess
[2012/12/28 13:30:25 | 000,000,000 | ---D | M] -- E:\ProgramData\BrowserProtect
[2011/03/17 13:17:26 | 000,000,000 | ---D | M] -- E:\ProgramData\DAEMON Tools Lite
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Documents
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favorites
[2011/03/17 13:40:24 | 000,000,000 | ---D | M] -- E:\ProgramData\mquadr.at
[2011/03/17 13:49:28 | 000,000,000 | ---D | M] -- E:\ProgramData\Partner
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Start Menu
[2010/11/06 11:48:32 | 000,000,000 | ---D | M] -- E:\ProgramData\Temp
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Templates
[2011/04/03 05:23:12 | 000,000,000 | ---D | M] -- E:\ProgramData\VirtualizedApplications
[2010/11/02 13:13:33 | 000,000,000 | ---D | M] -- E:\ProgramData\X10 Settings
[2011/09/08 11:20:06 | 000,000,000 | -H-D | M] -- E:\ProgramData\{6B3B2B58-1531-427B-BBBF-916BC14A9172}
[2013/04/11 10:10:45 | 000,032,640 | ---- | M] () -- E:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
< End of report >
Hier jedenfalls mal das OTL.txt:OTL Logfile: Code:
ATTFilter OTL logfile created on: 5/26/2013 3:21:32 PM - Run
OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium (Version = 6.1.7600) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 89.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = E: | %SystemRoot% = E:\Windows | %ProgramFiles% = E:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 75.27 Mb Free Space | 75.28% Space Free | Partition Type: NTFS
Drive E: | 546.25 Gb Total Space | 481.89 Gb Free Space | 88.22% Space Free | Partition Type: NTFS
Drive F: | 48.83 Gb Total Space | 6.77 Gb Free Space | 13.87% Space Free | Partition Type: NTFS
Drive G: | 7.45 Gb Total Space | 7.45 Gb Free Space | 100.00% Space Free | Partition Type: FAT32
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
========== Win32 Services (SafeList) ==========
SRV:64bit: - [2010/09/22 21:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/03/14 12:13:28 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- E:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/14 10:05:23 | 002,469,992 | ---- | M] () [Auto] -- E:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe -- (BrowserProtect)
SRV - [2011/10/01 03:30:22 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand] -- E:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 03:30:18 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/07/31 13:09:14 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- E:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/05/10 08:56:47 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- E:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2010/03/18 16:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- E:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/03/03 23:16:06 | 000,013,336 | ---- | M] (Intel Corporation) [Auto] -- E:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2009/12/10 02:48:26 | 002,320,920 | ---- | M] (Intel Corporation) [Auto] -- E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2009/12/10 02:48:24 | 000,268,824 | ---- | M] (Intel Corporation) [Auto] -- E:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009/11/07 06:46:52 | 000,020,480 | ---- | M] (X10) [Auto] -- E:\Program Files (x86)\Common Files\X10\Common\X10nets.exe -- (x10nets)
SRV - [2009/10/22 20:05:40 | 000,118,560 | ---- | M] (Wistron Corp.) [On_Demand] -- E:\Program Files (x86)\Launch Manager\WisLMSvc.exe -- (WisLMSvc)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- E:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2007/07/24 06:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- E:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2011/10/01 03:30:22 | 000,022,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV:64bit: - [2011/10/01 03:30:18 | 000,268,648 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV:64bit: - [2011/10/01 03:30:18 | 000,025,960 | ---- | M] (Microsoft Corporation) [File_System | On_Demand] -- E:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV:64bit: - [2011/10/01 03:30:10 | 000,764,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV:64bit: - [2011/07/31 13:09:14 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System] -- E:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2011/07/31 13:09:14 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto] -- E:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2010/09/30 07:00:06 | 000,180,736 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010/09/30 07:00:06 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010/08/25 14:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010/06/21 09:15:54 | 000,287,232 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010/06/09 08:00:50 | 001,887,528 | ---- | M] (Trident Microsystems, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\TrdCap64.sys -- (TrdCap64)
DRV:64bit: - [2010/05/24 09:46:36 | 000,246,304 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- E:\Windows\System32\Drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:64bit: - [2010/03/04 11:53:02 | 000,075,816 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2010/03/02 07:25:26 | 001,098,784 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand] -- E:\Windows\System32\drivers\rtl8192se.sys -- (rtl8192se)
DRV:64bit: - [2010/02/26 23:02:12 | 000,158,976 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\Impcd.sys -- (Impcd)
DRV:64bit: - [2010/02/22 04:09:10 | 000,011,776 | ---- | M] (MBB Incorporated) [Kernel | On_Demand] -- E:\Windows\System32\drivers\massfilter.sys -- (massfilter)
DRV:64bit: - [2010/02/04 07:54:32 | 001,888,864 | ---- | M] (NXP Semiconductors Germany GmbH) [Kernel | On_Demand] -- E:\Windows\System32\drivers\NxpCap64.sys -- (NxpCap64)
DRV:64bit: - [2009/10/12 10:23:22 | 000,114,304 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ewusbdev.sys -- (hwusbdev)
DRV:64bit: - [2009/09/24 05:52:34 | 000,913,888 | ---- | M] (DiBcom SA) [Kernel | On_Demand] -- E:\Windows\System32\drivers\mod77-64.sys -- (mod7764)
DRV:64bit: - [2009/09/17 22:54:54 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\HECIx64.sys -- (HECIx64) Intel(R)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- E:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:35:42 | 000,187,392 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand] -- E:\Windows\System32\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- E:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/05/13 15:47:44 | 000,032,792 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\Drivers\x10ufx2.sys -- (XUIF)
DRV:64bit: - [2009/05/13 15:26:14 | 000,015,896 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- E:\Windows\System32\Drivers\x10hid.sys -- (X10Hid)
DRV:64bit: - [2007/07/11 05:09:56 | 000,112,512 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- E:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Florian_ON_E\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = Google
IE - HKU\Florian_ON_E\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI
IE - HKU\Florian_ON_E\Software\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\Florian_ON_E\Software\Microsoft\Internet Explorer\Main,Start Page = Google
IE - HKU\Florian_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\LocalService_ON_E\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\System32\Macromed\Flash\NPSWF64_11_6_602_180.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: E:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: E:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/ShockwavePlayer: E:\Windows\SysWOW64\Adobe\Director\np32dsw_1200112.dll (Adobe Systems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: E:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/GENUINE: File not found
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: E:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: E:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: E:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: E:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: E:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{58bd07eb-0ee0-4df0-8121-dc9b693373df}: C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension [2012/12/28 13:30:26 | 000,000,000 | ---D | M]
[2012/10/01 09:06:58 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Florian\AppData\Roaming\Mozilla\Extensions
[2012/10/01 09:06:58 | 000,000,000 | ---D | M] (No name found) -- E:\Users\Florian\AppData\Roaming\Mozilla\Extensions\{SbX-155247-9783706842167-stu10}
[2012/12/28 13:30:17 | 000,000,000 | ---D | M] (No name found) -- E:\Program Files (x86)\Mozilla Firefox\extensions
O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - E:\Windows\System32\drivers\etc\hosts
O2:64bit: - BHO: (DataMngr) - {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} - E:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\BrowserConnection.dll (Bandoo Media Inc)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - E:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.8.7.2\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (DataMngr) - {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} - E:\Program Files (x86)\Search Results Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media Inc)
O2 - BHO: (Search-Results Toolbar) - {f34c9277-6577-4dff-b2d7-7d58092f272f} - E:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - E:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.8.7.2\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Search-Results Toolbar) - {f34c9277-6577-4dff-b2d7-7d58092f272f} - E:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4:64bit: - HKLM..\Run: [RtHDVBg] E:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] E:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] E:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DATAMNGR] E:\Program Files (x86)\Search Results Toolbar\Datamngr\datamngrUI.exe (Bandoo Media Inc)
O4 - HKLM..\Run: [HotkeyApp] E:\Program Files (x86)\Launch Manager\HotkeyApp.exe (Wistron)
O4 - HKLM..\Run: [LMgrOSD] File not found
O4 - HKLM..\Run: [LMgrVolOSD] E:\Program Files (x86)\Launch Manager\OSD.exe (Wistron Corp.)
O4 - HKLM..\Run: [NUSB3MON] E:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [Wbutton] E:\Program Files (x86)\Launch Manager\Wbutton.exe (Wistron Corp.)
O4 - HKU\LocalService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_E..\Run: [Sidebar] E:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_E..\RunOnce: [mctadmin] File not found
O4 - HKU\NetworkService_ON_E..\RunOnce: [mctadmin] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O9:64bit: - Extra Button: eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found
O9:64bit: - Extra 'Tools' menuitem : eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found
O9 - Extra Button: eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found
O9 - Extra 'Tools' menuitem : eBay.at - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - File not found
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} hxxp://91.113.220.122/activex/AMC.cab (AxisMediaControlEmb Class)
O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - Reg Error: Key error. File not found
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll) - E:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\datamngr.dll (Bandoo Media Inc)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll) - E:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\IEBHO.dll (Bandoo Media Inc)
O20 - AppInit_DLLs: (c:\progra~3\browse~1\251005~1.80\{c16c1~1\browse~1.dll) - E:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - E:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - E:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKU\Florian_ON_E Winlogon: Shell - (explorer.exe) - E:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKU\Florian_ON_E Winlogon: Shell - (C:\Users\Florian\AppData\Roaming\skype.dat) - E:\Users\Florian\AppData\Roaming\skype.dat ()
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{15c05717-a038-11e1-9e5c-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15c05717-a038-11e1-9e5c-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{15c05720-a038-11e1-9e5c-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15c05720-a038-11e1-9e5c-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{15ef4256-47f5-11e0-9dd5-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15ef4256-47f5-11e0-9dd5-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{15ef4265-47f5-11e0-9dd5-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15ef4265-47f5-11e0-9dd5-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{15ef4267-47f5-11e0-9dd5-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{15ef4267-47f5-11e0-9dd5-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{17f17a45-50b9-11e0-aac0-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{17f17a45-50b9-11e0-aac0-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{17f17a53-50b9-11e0-aac0-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{17f17a53-50b9-11e0-aac0-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{4d9a9eba-2524-11e0-8f53-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{4d9a9eba-2524-11e0-8f53-806e6f6e6963}\Shell\AutoRun\command - "" = E:\cdstart.exe
O33 - MountPoints2\{552b7940-47f9-11e0-8eb8-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{552b7940-47f9-11e0-8eb8-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{552b7942-47f9-11e0-8eb8-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{552b7942-47f9-11e0-8eb8-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{6e7e3b9c-523d-11e0-a8ca-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{6e7e3b9c-523d-11e0-a8ca-485d60465352}\Shell\AutoRun\command - "" = H:\AutoRun.exe
O33 - MountPoints2\{79b6d9a4-b7be-11e1-91ad-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{79b6d9a4-b7be-11e1-91ad-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{84ebdeae-ddac-11e1-aa4b-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{84ebdeae-ddac-11e1-aa4b-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{962c8a44-e2da-11e0-a52c-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{962c8a44-e2da-11e0-a52c-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{983e8907-4dd5-11e2-a5c5-00262dc3534e}\Shell - "" = AutoRun
O33 - MountPoints2\{983e8907-4dd5-11e2-a5c5-00262dc3534e}\Shell\AutoRun\command - "" = E:\cdstart.exe
O33 - MountPoints2\{c04b7e29-bec5-11e1-914e-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{c04b7e29-bec5-11e1-914e-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{c04b7e2b-bec5-11e1-914e-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{c04b7e2b-bec5-11e1-914e-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{e566942f-da2c-11e0-a997-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{e566942f-da2c-11e0-a997-485d60465352}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{ebb4f2fe-70c4-11e0-a6ee-001e101f2500}\Shell - "" = AutoRun
O33 - MountPoints2\{ebb4f2fe-70c4-11e0-a6ee-001e101f2500}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{fdc9e9cd-dadb-11e0-a6c8-485d60465352}\Shell - "" = AutoRun
O33 - MountPoints2\{fdc9e9cd-dadb-11e0-a6c8-485d60465352}\Shell\AutoRun\command - "" = G:\AutoRun.exe
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\H\Shell - "" = AutoRun
O33 - MountPoints2\H\Shell\AutoRun\command - "" = H:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[1 E:\Windows\*.tmp files -> E:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013/05/11 04:40:08 | 000,067,584 | --S- | M] () -- E:\Windows\bootstat.dat
[2013/05/11 04:40:04 | 000,001,110 | ---- | M] () -- E:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/11 04:40:03 | 000,000,884 | ---- | M] () -- E:\Windows\tasks\Adobe Flash Player Updater.job
[2013/05/11 04:39:15 | 000,654,852 | ---- | M] () -- E:\Windows\System32\perfh007.dat
[2013/05/11 04:39:15 | 000,616,694 | ---- | M] () -- E:\Windows\System32\perfh009.dat
[2013/05/11 04:39:15 | 000,130,434 | ---- | M] () -- E:\Windows\System32\perfc007.dat
[2013/05/11 04:39:15 | 000,106,816 | ---- | M] () -- E:\Windows\System32\perfc009.dat
[2013/05/11 04:38:23 | 000,000,004 | ---- | M] () -- E:\Users\Florian\AppData\Roaming\skype.ini
[2013/05/11 03:31:16 | 000,001,106 | ---- | M] () -- E:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/11 03:30:21 | 3061,960,704 | -HS- | M] () -- E:\hiberfil.sys
[2013/05/06 11:38:34 | 000,010,096 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/06 11:38:34 | 000,010,096 | -H-- | M] () -- E:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/05 09:10:47 | 322,613,881 | ---- | M] () -- E:\Windows\MEMORY.DMP
[2013/04/30 16:12:31 | 000,000,374 | ---- | M] () -- E:\Windows\System32\drivers\etc\hosts.ics
[1 E:\Windows\*.tmp files -> E:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013/05/04 18:12:45 | 000,000,004 | ---- | C] () -- E:\Users\Florian\AppData\Roaming\skype.ini
[2012/03/16 10:07:40 | 000,102,400 | ---- | C] () -- E:\Users\Florian\AppData\Roaming\skype.dat
[2011/03/17 13:30:31 | 000,000,400 | ---- | C] () -- E:\Windows\ODBC.INI
[2011/03/16 10:25:13 | 001,527,912 | ---- | C] () -- E:\Windows\SysWow64\PerfStringBackup.INI
[2010/11/03 13:47:42 | 000,000,000 | ---- | C] () -- E:\Windows\Bench32.INI
[2010/11/02 13:04:22 | 000,127,184 | ---- | C] () -- E:\Windows\Unwise.exe
[2010/11/02 13:04:21 | 000,149,504 | ---- | C] () -- E:\Windows\unwise32_setup.exe
[2010/11/02 12:49:13 | 000,451,072 | ---- | C] () -- E:\Windows\SysWow64\ISSRemoveSP.exe
[2010/11/02 12:10:54 | 000,870,560 | ---- | C] () -- E:\Windows\SysWow64\igkrng575.bin
[2010/11/02 12:10:54 | 000,208,896 | ---- | C] () -- E:\Windows\SysWow64\iglhsip32.dll
[2010/11/02 12:10:54 | 000,143,360 | ---- | C] () -- E:\Windows\SysWow64\iglhcp32.dll
[2010/11/02 12:10:54 | 000,104,796 | ---- | C] () -- E:\Windows\SysWow64\igfcg575m.bin
[2010/11/02 12:10:52 | 000,127,868 | ---- | C] () -- E:\Windows\SysWow64\igcompkrng575.bin
[2010/06/08 09:19:24 | 000,692,224 | ---- | C] () -- E:\Windows\SysWow64\libeay32.dll
[2010/06/08 09:19:24 | 000,151,552 | ---- | C] () -- E:\Windows\SysWow64\ssleay32.dll
[2010/04/20 10:31:43 | 000,936,832 | ---- | C] () -- E:\Windows\SysWow64\M2ElevatedCalls.dll
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- E:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- E:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- E:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- E:\Windows\mib.bin
[2009/07/13 20:02:54 | 000,245,248 | ---- | C] () -- E:\Windows\SysWow64\DShowRdpFilter.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- E:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- E:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- E:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- E:\Windows\SysWow64\mlang.dat
[2008/10/07 04:13:30 | 000,197,912 | ---- | C] () -- E:\Windows\SysWow64\physxcudart_20.dll
[2008/10/07 04:13:22 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelTraditionalChinese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSwedish.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSpanish.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelPortugese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelKorean.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelJapanese.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelGerman.dll
[2008/10/07 04:13:20 | 000,058,648 | ---- | C] () -- E:\Windows\SysWow64\AgCPanelFrench.dll
[2003/02/20 12:53:42 | 000,005,702 | ---- | C] () -- E:\Windows\SysWow64\OUTLPERF.INI
========== LOP Check ==========
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Application Data
[2012/12/28 13:30:02 | 000,000,000 | ---D | M] -- E:\ProgramData\Babylon
[2012/12/02 02:34:48 | 000,000,000 | ---D | M] -- E:\ProgramData\boost_interprocess
[2012/12/28 13:30:25 | 000,000,000 | ---D | M] -- E:\ProgramData\BrowserProtect
[2011/03/17 13:17:26 | 000,000,000 | ---D | M] -- E:\ProgramData\DAEMON Tools Lite
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Documents
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Favorites
[2011/03/17 13:40:24 | 000,000,000 | ---D | M] -- E:\ProgramData\mquadr.at
[2011/03/17 13:49:28 | 000,000,000 | ---D | M] -- E:\ProgramData\Partner
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Start Menu
[2010/11/06 11:48:32 | 000,000,000 | ---D | M] -- E:\ProgramData\Temp
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- E:\ProgramData\Templates
[2011/04/03 05:23:12 | 000,000,000 | ---D | M] -- E:\ProgramData\VirtualizedApplications
[2010/11/02 13:13:33 | 000,000,000 | ---D | M] -- E:\ProgramData\X10 Settings
[2011/09/08 11:20:06 | 000,000,000 | -H-D | M] -- E:\ProgramData\{6B3B2B58-1531-427B-BBBF-916BC14A9172}
[2013/04/11 10:10:45 | 000,032,640 | ---- | M] () -- E:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
< End of report >
Sorry hab es ausversehen 2mal gepostet!! |
|
26.05.2013, 18:14
| #18 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | laptop von der österreichischen polizei gesperrt! Mach einen OTL-Fix über OTLPE, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)
__________________Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!! Code:
ATTFilter :OTL
O20 - HKU\Florian_ON_E Winlogon: Shell - (C:\Users\Florian\AppData\Roaming\skype.dat) - E:\Users\Florian\AppData\Roaming\skype.dat ()
:Files
E:\Users\Florian\AppData\Roaming\skype.dat
E:\Users\Florian\AppData\Roaming\skype.ini
:Commands
[purity]
[resethosts]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt. Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann! Danach sollte Windows wieder normal starten - stell uns bitte den Quarantäneordner von OTL zur Verfügung. Dabei bitte so vorgehen: 1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinträchtigen! 2.) Ordner movedfiles in C:\_OTL in eine Datei zippen 3.) Die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten! 4.) Wenns erfolgreich war Bescheid sagen 5.) Erst dann wieder den Virenscanner einschalten
__________________ |
|
27.05.2013, 15:25
| #19 |
| | laptop von der österreichischen polizei gesperrt! Wo ist die custom scan fix Box? Im OTL oder im OTLPE? |
|
27.05.2013, 16:06
| #20 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | laptop von der österreichischen polizei gesperrt! Der Textbereich unten in OTLPE
__________________ Logfiles bitte immer in CODE-Tags posten |
|
03.06.2013, 20:56
| #21 |
| | laptop von der österreichischen polizei gesperrt! Danke cosinus!!! Der Laptop funktioniert wieder seit ein paar Tage. Danke nochmal, und viel Erfolg beim weiteren Fälle lösen |
|
04.06.2013, 10:24
| #22 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | laptop von der österreichischen polizei gesperrt! Wir sind hier noch nicht fertig! Du solltest das Log posten und die OTLPE-Q bei uns hochladen
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu laptop von der österreichischen polizei gesperrt! |
| 100 euro zahlen, angeblich, arten, bezahlen, bild, erneute, euro, gesperrt, google, googlen, handy, hoffe, interne, internet, laptop, laptop gesperrt, niemand, pay safe, plötzlich, polizei, software, starte, starten, unerfahren, verständliche, virus, weißer, ähnliches |
Linear-Darstellung
