Bundespolizeivirus auf Windows XP - Fix benötigt

badkarmainc · 08.07.2014, 19:48

Guten Abend liebe Mitglieder des Trojaner-Boards,

Ich habe mir vor etwa einem halben Jahr auf einem alten Laptop den Bundespolizeivirus eingefangen. Aus mangelndem Bedarf habe ich ihn dann lange liegengelassen, wollte den Virus aber jetzt doch mal beseitigen.

Ich habe bereits mit OTLPE einen Scan gemacht und dabei File Age auf 360 days gestellt. Da der Virus ja schon lange auf dem Laptop ist, schien mir das sinnvoll - ich hoffe es war nicht falsch.

Das Betriebssystem ist Windows XP.

Wenn mir jemand einen Fixlog anfertigen könnte, wäre das toll. Ich denke, weiter käme ich dann alleine. Vielen Dank!

Anbei die beiden logs.

Lieben Gruss,
Marius

schrauber · 08.07.2014, 20:57

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

badkarmainc · 08.07.2014, 22:02

Hi,

Oh, ok, tut mir leid!

Hab sie jetzt hier gepostet.

Vielen Dank nochmal.

Code:

ATTFilter

OTL logfile created on: 8/28/2013 2:53:14 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
511.00 Mb Total Physical Memory | 193.00 Mb Available Physical Memory | 38.00% Memory free
463.00 Mb Paging File | 207.00 Mb Available in Paging File | 45.00% Paging File free
Paging file location(s): C:\pagefile.sys 1024 1024 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 27.95 Gb Total Space | 4.45 Gb Free Space | 15.92% Space Free | Partition Type: NTFS
Drive D: | 22.47 Gb Total Space | 5.45 Gb Free Space | 24.27% Space Free | Partition Type: NTFS
Drive E: | 118.48 Mb Total Space | 99.52 Mb Free Space | 83.99% Space Free | Partition Type: FAT
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = All Days
Using ControlSet: ControlSet002
 
========== Win32 Services (SafeList) ==========
 
SRV - (AppMgmt) --  File not found
SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (LVSrvLauncher) -- C:\Programme\Gemeinsame Dateien\LogiShrd\SrvLnch\SrvLnch.exe (Logitech Inc.)
SRV - (LVPrcSrv) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (LVCOMSer) -- C:\Programme\Gemeinsame Dateien\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)
SRV - (VCI) -- C:\Programme\Sony\VAIO Cooperated Initialisation\VCI_svc.exe (Sony Corporation)
SRV - (VAIO Entertainment Task Scheduler) -- C:\Programme\Sony\VAIO Entertainment\VzTaskScheduler.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-IntegratedServer-AppServer) -- C:\Programme\Sony\VAIO Media Integrated Server\VMISrv.exe (Sony Corporation)
SRV - (VAIO Entertainment Aggregation and Control Service) -- C:\Programme\Gemeinsame Dateien\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe (Sony Corporation)
SRV - (VAIO Entertainment File Import Service) -- C:\Programme\Gemeinsame Dateien\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe (Sony Corporation)
SRV - (VAIO Entertainment TV Device Arbitration Service) -- C:\Programme\Gemeinsame Dateien\Sony Shared\VAIO Entertainment\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe (Sony Corporation)
SRV - (VAIO Entertainment UPnP Client Adapter) -- C:\Programme\Gemeinsame Dateien\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-IntegratedServer-UPnP) VAIO Media Integrated Server (UPnP) -- C:\Programme\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-IntegratedServer-HTTP) VAIO Media Integrated Server (HTTP) -- C:\Programme\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe (Sony Corporation)
SRV - (VAIOMediaPlatform-Mobile-Gateway) -- C:\Programme\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe (Sony Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WDICA) --  File not found
DRV - (PDRFRAME) --  File not found
DRV - (PDRELI) --  File not found
DRV - (PDFRAME) --  File not found
DRV - (PDCOMP) --  File not found
DRV - (PCIDump) --  File not found
DRV - (lbrtfdc) --  File not found
DRV - (i2omgmt) --  File not found
DRV - (Changer) --  File not found
DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\WINDOWS\system32\drivers\s0016unic.sys (MCCI Corporation)
DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\WINDOWS\system32\drivers\s0016nd5.sys (MCCI Corporation)
DRV - (s0016mdfl) -- C:\WINDOWS\system32\drivers\s0016mdfl.sys (MCCI Corporation)
DRV - (s0016mdm) -- C:\WINDOWS\system32\drivers\s0016mdm.sys (MCCI Corporation)
DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\WINDOWS\system32\drivers\s0016mgmt.sys (MCCI Corporation)
DRV - (s0016obex) -- C:\WINDOWS\system32\drivers\s0016obex.sys (MCCI Corporation)
DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\WINDOWS\system32\drivers\s0016bus.sys (MCCI Corporation)
DRV - (LVMVDrv) -- C:\WINDOWS\system32\drivers\LVMVdrv.sys (Logitech Inc.)
DRV - (LVcKap) -- C:\WINDOWS\system32\drivers\Lvckap.sys (Logitech Inc.)
DRV - (LVUVC) Logitech QuickCam Pro 9000(UVC) -- C:\WINDOWS\system32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (FilterService) -- C:\WINDOWS\system32\drivers\lvuvcflt.sys (Logitech Inc.)
DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (lvpopflt) -- C:\WINDOWS\system32\drivers\lvpopflt.sys (Logitech Inc.)
DRV - (LVPr2Mon) -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()
DRV - (hwdatacard) -- C:\WINDOWS\system32\drivers\ewusbmdm.sys (Huawei Technologies Co., Ltd.)
DRV - (sfsync04) StarForce Protection Synchronization Driver (version 4.x) -- C:\WINDOWS\system32\drivers\sfsync04.sys (Protection Technology (StarForce))
DRV - (sfdrv01a) StarForce Protection Environment Driver (version 1.x.a) -- C:\WINDOWS\system32\drivers\sfdrv01a.sys (Protection Technology (StarForce))
DRV - (sfvfs02) StarForce Protection VFS Driver (version 2.x) -- C:\WINDOWS\system32\drivers\sfvfs02.sys (Protection Technology (StarForce))
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\WINDOWS\system32\drivers\sfhlp02.sys (Protection Technology (StarForce))
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\WINDOWS\system32\drivers\sfdrv01.sys (Protection Technology (StarForce))
DRV - (G3GRUMDM) -- C:\WINDOWS\system32\drivers\g3grumdm.sys (Option N.V.)
DRV - (G3GRUSER) -- C:\WINDOWS\system32\drivers\g3gruser.sys (Option N.V.)
DRV - (STEC3) -- C:\WINDOWS\system32\STEC3.sys (AntiCracking)
DRV - (StMp3Rec) -- C:\WINDOWS\system32\drivers\StMp3Rec.sys (Generic)
DRV - (actser) -- C:\WINDOWS\system32\drivers\actser.sys (Siemens AG)
DRV - (aliadwdm) -- C:\WINDOWS\system32\drivers\ac97ali.sys (Acer Laboratories Inc.)
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (siusbmod) -- C:\WINDOWS\system32\drivers\siusbmod.sys (Siemens AG )
DRV - (LEX_AS_NIC_SERVICE_YNOS) -- C:\WINDOWS\system32\drivers\ExpasAG.sys (Atheros Communications, Inc.)
DRV - (PrivateDisk) -- C:\WINDOWS\system32\drivers\privatediskm.sys (Utimaco Safeware AG)
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (tifmsony) -- C:\WINDOWS\system32\drivers\tifmsony.sys (Texas Instruments)
DRV - (prohlp02) -- C:\WINDOWS\system32\drivers\prohlp02.sys (Protection Technology)
DRV - (prodrv06) -- C:\WINDOWS\System32\drivers\prodrv06.sys (Protection Technology)
DRV - (ALCXSENS) -- C:\WINDOWS\system32\drivers\ALCXSENS.SYS (Sensaura Ltd)
DRV - (HSFHWALI) -- C:\WINDOWS\system32\drivers\HSFHWALI.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (sfhlp01) -- C:\WINDOWS\system32\drivers\sfhlp01.sys (Protection Technology)
DRV - (odysseyIM3) -- C:\WINDOWS\system32\drivers\odysseyIM3.sys (Funk Software, Inc.)
DRV - (RTL8023) -- C:\WINDOWS\system32\drivers\Rtlnic51.sys (Realtek Semiconductor Corporation                           )
DRV - (ApfiltrService) -- C:\WINDOWS\system32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (prosync1) -- C:\WINDOWS\system32\drivers\prosync1.sys (Protection Technology)
DRV - (caboagp) -- C:\WINDOWS\system32\drivers\atisgkaf.SYS (ATI Technologies Inc.)
DRV - (DMICall) -- C:\WINDOWS\system32\drivers\DMICall.sys (Sony Corporation)
DRV - (SNC) -- C:\WINDOWS\system32\drivers\SonyNC.sys (Sony Corporation)
DRV - (Aspi32) -- C:\WINDOWS\System32\drivers\ASPI32.sys (Adaptec)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.club-vaio.com/de
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.club-vaio.com/de
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\LocalService_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.club-vaio.com/de
 
IE - HKU\Marius_Kals_ON_C\Software\Microsoft\Internet Explorer\Main,Prev Search Page = hxxp://www.google.com
IE - HKU\Marius_Kals_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\Marius_Kals_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\Marius_Kals_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\Marius_Kals_ON_C\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll (ICQ Inc.)
IE - HKU\Marius_Kals_ON_C\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
IE - HKU\Marius_Kals_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Marius_Kals_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
IE - HKU\NetworkService_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.club-vaio.com/de
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: D:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.3: C:\Programme\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Programme\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1:  File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\Programme\Google\Google Gears\Firefox\ [2010/05/08 06:10:58 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Components: c:\programme\Mozilla Firefox\components [2011/12/18 11:50:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.5.9\extensions\\Plugins: c:\programme\Mozilla Firefox\plugins [2011/12/18 11:50:06 | 000,000,000 | ---D | M]
 
[2013/05/21 19:01:32 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011/12/18 11:49:56 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/12/18 11:49:56 | 000,002,344 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011/12/18 11:49:56 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/12/18 11:49:56 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/12/18 11:49:56 | 000,000,801 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004/08/04 08:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O2 - BHO: (myBar BHO) - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} -  File not found
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Windows Live Anmelde-Hilfsprogramm) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Programme\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (ICQ  Toolbar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll (ICQ Inc.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O3 - HKU\Marius_Kals_ON_C\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\Marius_Kals_ON_C\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.
O3 - HKU\Marius_Kals_ON_C\..\Toolbar\WebBrowser: (ICQ  Toolbar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll (ICQ Inc.)
O3 - HKU\Marius_Kals_ON_C\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [FB41AE3B] C:\WINDOWS\system32\windows_32.exe ()
O4 - HKLM..\Run: [HKSERV.EXE] C:\Programme\Sony\HotKey Utility\HKServ.exe (Sony Corporation)
O4 - HKLM..\Run: [SonyPowerCfg] C:\Programme\Sony\VAIO Power Management\SPMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [VAIO Update 2] C:\Programme\Sony\VAIO Update 2\VAIOUpdt.exe (Sony Corporation)
O4 - HKU\Marius_Kals_ON_C..\Run: [Symantec NetDriver Monitor]  File not found
O4 - HKU\Marius_Kals_ON_C..\Run: [Yahoo! Pager] C:\Programme\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Logitech Desktop Messenger.lnk = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Marius_Kals_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Marius_Kals_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 64
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : &Gears-Einstellungen - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Programme\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll (Google Inc.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -  File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -  File not found
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\ICQ6\ICQ.exe (ICQ, Inc.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - D:\ICQ6\ICQ.exe (ICQ, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} hxxp://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab (Minesweeper Flags Class)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Programme\Yahoo!\Common\yinsthelper.dll (YInstStarter Class)
O16 - DPF: {53B8B406-42E4-4DD3-96E7-9DEC8CEB3DD8} hxxp://xtraz.icq.com/xtraz/activex/ICQVideoControl.cab (ICQVideoControl Class)
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} https://www.gamespyid.com/alaunch.cab (GSDACtl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} hxxp://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab (MessengerStatsClient Class)
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} hxxp://messenger.msn.com/download/msnmessengersetupdownloader.cab (MsnMessengerSetupDownloadControl Class)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab (Minesweeper Flags Class)
O16 - DPF: {FB48C7B0-EB66-4BE6-A1C5-9DDF3C37249A} hxxp://xtraz.icq.com/xtraz/activex/MISBH.cab (MCSendMessageHandler Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKU\Marius_Kals_ON_C Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKU\Marius_Kals_ON_C Winlogon: Shell - (C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\skype.dat) - C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\skype.dat ()
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll ()
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/18 10:46:45 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within All Days ==========
 
File not found -- C:\Dokumente und Einstellungen\Marius Kals\Desktop\codeneu[1].zip.
File not found -- C:\Dokumente und Einstellungen\Marius Kals\Desktop\bmhhandbuch[1].pdf.
File not found -- C:\Dokumente und Einstellungen\Marius Kals\Desktop\bmheditor[1].zip.
File not found -- C:\Dokumente und Einstellungen\Marius Kals\Desktop\bmh20-3punkte[1].rar.
File not found -- C:\Dokumente und Einstellungen\Marius Kals\Desktop\bmh139[1].zip.
[2013/08/28 13:25:00 | 000,000,000 | ---D | C] -- C:\_OTL
[2013/08/28 10:34:45 | 000,000,000 | ---D | C] -- C:\ Malwarebytes Anti-Malware 
[2005/10/21 10:08:44 | 000,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\vax347s.sys
[2004/08/18 03:31:47 | 000,131,072 | ---- | C] ( ) -- C:\WINDOWS\System32\ATIDEMGR.dll
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within All Days ==========
 
File not found -- C:\Dokumente und Einstellungen\Marius Kals\Desktop\codeneu[1].zip.
File not found -- C:\Dokumente und Einstellungen\Marius Kals\Desktop\bmhhandbuch[1].pdf.
File not found -- C:\Dokumente und Einstellungen\Marius Kals\Desktop\bmheditor[1].zip.
File not found -- C:\Dokumente und Einstellungen\Marius Kals\Desktop\bmh20-3punkte[1].rar.
File not found -- C:\Dokumente und Einstellungen\Marius Kals\Desktop\bmh139[1].zip.
[2013/08/28 07:29:55 | 000,000,004 | ---- | M] () -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\skype.ini
[2013/08/28 07:28:41 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/08/28 07:28:29 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/08/28 04:38:13 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013/05/22 18:03:20 | 000,001,090 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/22 14:05:32 | 000,452,038 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2013/05/22 14:05:32 | 000,434,838 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/05/22 14:05:32 | 000,081,842 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2013/05/22 14:05:32 | 000,068,828 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/05/22 12:54:42 | 000,001,839 | ---- | M] () -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/05/22 18:37:33 | 000,000,004 | ---- | C] () -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\skype.ini
[2009/12/16 19:14:19 | 000,000,218 | ---- | C] () -- C:\Dokumente und Einstellungen\Marius Kals\.recently-used.xbel
[2009/10/28 11:59:58 | 000,175,104 | ---- | C] () -- C:\WINDOWS\MM_Bahn_V3_Uninstall.exe
[2009/06/16 15:13:27 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2009/03/26 20:21:45 | 000,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009/03/26 20:20:00 | 000,051,712 | ---- | C] () -- C:\WINDOWS\System32\coodest.dll
[2008/07/06 10:22:49 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\windows_32.exe
[2008/05/26 20:17:50 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2008/01/02 20:45:16 | 000,058,163 | R--- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2007/07/18 12:42:42 | 000,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys
[2006/11/14 12:53:57 | 000,000,484 | ---- | C] () -- C:\WINDOWS\eReg.dat
[2006/11/07 19:43:13 | 000,001,755 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\QTSBandwidthCache
[2006/07/28 07:35:51 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\NwtGatewayDLL.dll
[2006/07/28 07:35:51 | 000,000,255 | ---- | C] () -- C:\WINDOWS\System32\NwtGatewayConfig.ini
[2006/07/28 07:35:51 | 000,000,255 | ---- | C] () -- C:\WINDOWS\NwtGatewayConfig.ini
[2005/10/25 14:10:36 | 000,000,112 | ---- | C] () -- C:\WINDOWS\ActiveSkin.INI
[2005/05/17 16:34:49 | 001,690,785 | ---- | C] () -- C:\Dokumente und Einstellungen\Marius Kals\Marius Kals.ace
[2005/04/07 16:31:54 | 000,000,144 | ---- | C] () -- C:\Dokumente und Einstellungen\Marius Kals\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
[2005/04/02 15:25:15 | 000,000,403 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2005/01/18 16:06:34 | 000,000,010 | ---- | C] () -- C:\WINDOWS\smdat32m.sys
[2005/01/18 16:06:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\smdat32a.sys
[2004/12/29 13:12:45 | 000,000,285 | ---- | C] () -- C:\WINDOWS\winamp.ini
[2004/12/29 13:12:43 | 000,088,064 | ---- | C] () -- C:\WINDOWS\System32\AudioExCtl.dll
[2004/12/29 13:07:15 | 000,001,528 | ---- | C] () -- C:\WINDOWS\CDCOPY.INI
[2004/12/24 20:17:54 | 000,000,029 | ---- | C] () -- C:\WINDOWS\AlphaPlayer.INI
[2004/12/24 14:28:30 | 000,176,640 | ---- | C] () -- C:\Dokumente und Einstellungen\Marius Kals\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/12/24 14:27:35 | 000,003,584 | ---- | C] () -- C:\WINDOWS\system32\config\systemprofile\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/09/02 07:47:11 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\Cpuinf32.dll
[2004/08/19 10:07:33 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/08/19 09:40:16 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2004/08/19 09:40:16 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2004/08/19 09:40:15 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2004/08/19 09:40:15 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2004/08/19 09:40:15 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2004/08/19 09:40:15 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2004/08/19 09:20:13 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/18 11:48:05 | 000,143,360 | ---- | C] () -- C:\WINDOWS\System32\WLANDLL.DLL
[2004/08/18 11:37:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/18 11:36:55 | 000,167,504 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/18 11:16:44 | 000,155,648 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2004/08/18 10:49:28 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/08/18 10:44:13 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/18 03:31:47 | 000,385,024 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.exe
[2004/08/18 03:31:47 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\ati2evxx.dll
[2004/08/18 03:31:44 | 000,002,403 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004/08/18 03:31:28 | 000,452,038 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004/08/18 03:31:28 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004/08/18 03:31:28 | 000,081,842 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004/08/18 03:31:28 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004/08/18 03:31:09 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/18 03:31:08 | 000,434,838 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/18 03:31:08 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/18 03:31:08 | 000,068,828 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/18 03:31:08 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/18 03:31:05 | 000,004,530 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/18 03:31:04 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/18 03:31:02 | 000,058,880 | ---- | C] () -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\skype.dat
[2004/08/18 03:31:02 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/08/18 03:30:56 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/18 03:30:56 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/18 03:30:47 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/18 03:30:39 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2004/06/24 00:28:12 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2002/08/06 04:55:37 | 000,024,576 | ---- | C] () -- C:\WINDOWS\ml-WA3Shutdown.exe
[2002/04/02 10:08:36 | 000,372,749 | ---- | C] () -- C:\WINDOWS\ml-uninstall-v10.exe
[2002/04/02 10:08:34 | 000,311,590 | ---- | C] () -- C:\WINDOWS\ml-cleanup.exe
[2002/04/02 10:08:32 | 000,036,868 | ---- | C] () -- C:\WINDOWS\ml-winamp-shutdown.exe
[2001/10/24 10:00:40 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\TDI-SonyOMG.dll
[2001/05/03 03:03:58 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\smcelp32.ini
[2001/05/03 03:03:58 | 000,000,219 | ---- | C] () -- C:\WINDOWS\System32\pspgru.ini
[1999/04/29 17:00:00 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL
[1998/12/11 06:55:00 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\pspsbext.ini
[1998/08/10 09:04:00 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\pspfidrv.ini
[1998/08/10 09:04:00 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\pspaudrv.ini
[1998/08/10 09:03:00 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\pspapdrv.ini
[1998/08/10 09:03:00 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\mcipspwa.ini
[1998/08/10 09:02:00 | 000,000,221 | ---- | C] () -- C:\WINDOWS\System32\pspfbase.ini
[1998/08/10 09:02:00 | 000,000,220 | ---- | C] () -- C:\WINDOWS\System32\pspwave.ini
[1998/08/10 09:02:00 | 000,000,219 | ---- | C] () -- C:\WINDOWS\System32\pspdss.ini
[1998/08/10 09:02:00 | 000,000,219 | ---- | C] () -- C:\WINDOWS\System32\pspddi.ini
[1997/06/14 04:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll
 
========== LOP Check ==========
 
[2013/05/21 19:08:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\.purple
[2005/04/07 16:33:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\Cornelsen
[2009/02/02 20:04:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\FIFA2003CC
[2009/12/24 10:46:32 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\gtk-2.0
[2008/07/08 19:06:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\ICQ
[2004/12/25 12:41:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\ICQLite
[2006/07/28 07:41:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\ICS
[2005/02/27 16:39:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\InterVideo
[2005/01/10 10:59:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\Leadertech
[2010/08/12 21:40:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\Pro Cycling Manager 2007
[2009/11/13 19:57:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\Pro Cycling Manager 2008
[2004/12/29 08:48:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\Template
[2006/07/28 07:43:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\Vodafone Mobile Connect
[2009/05/10 08:29:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BVRP Software
[2010/05/08 06:08:23 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
 
========== Purity Check ==========
 
 
< End of report >

Code:

ATTFilter

OTL Extras logfile created on: 8/28/2013 2:53:14 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
511.00 Mb Total Physical Memory | 193.00 Mb Available Physical Memory | 38.00% Memory free
463.00 Mb Paging File | 207.00 Mb Available in Paging File | 45.00% Paging File free
Paging file location(s): C:\pagefile.sys 1024 1024 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 27.95 Gb Total Space | 4.45 Gb Free Space | 15.92% Space Free | Partition Type: NTFS
Drive D: | 22.47 Gb Total Space | 5.45 Gb Free Space | 24.27% Space Free | Partition Type: NTFS
Drive E: | 118.48 Mb Total Space | 99.52 Mb Free Space | 83.99% Space Free | Partition Type: FAT
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = All Days
Using ControlSet: ControlSet002
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office\msohtmed.exe" /p %1 (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- D:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- D:\Programme\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\Winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Programme\Winamp\Winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"5190:TCP" = 5190:TCP:*:Enabled:ICQ
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger -- (Logitech Inc.)
 
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\ICQLite\ICQLite.exe" = C:\Programme\ICQLite\ICQLite.exe:*:Enabled:ICQ Lite
"C:\WINDOWS\system32\dplaysvr.exe" = C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper -- (Microsoft Corporation)
"C:\Programme\Microsoft Games\Age of Empires II\EMPIRES2.ICD" = C:\Programme\Microsoft Games\Age of Empires II\EMPIRES2.ICD:*:Enabled:Age of Empires II -- (Microsoft Corporation)
"C:\Programme\Kazaa\kazaa.exe" = C:\Programme\Kazaa\kazaa.exe:*:Enabled:Kazaa
"C:\Programme\Cyanide\Radsport Manager\CYM2003.EXE" = C:\Programme\Cyanide\Radsport Manager\CYM2003.EXE:*:Enabled:CyclingManager
"C:\Programme\GameSpy Arcade\Aphex.exe" = C:\Programme\GameSpy Arcade\Aphex.exe:*:Enabled:GameSpy Arcade
"C:\Programme\Microsoft Games\Age of Empires II\aoe20a_crk.exe" = C:\Programme\Microsoft Games\Age of Empires II\aoe20a_crk.exe:*:Enabled:Age of Empires II -- (Microsoft Corporation)
"C:\Programme\Cyanide\Radsport Manager 20042005\Cym2004.exe" = C:\Programme\Cyanide\Radsport Manager 20042005\Cym2004.exe:*:Enabled:CyclingManager
"C:\Programme\iTunes\iTunes.exe" = C:\Programme\iTunes\iTunes.exe:*:Enabled:iTunes
"C:\Programme\Cyanide\Radsportmanager Pro 2005-2006\Cym2005.exe" = C:\Programme\Cyanide\Radsportmanager Pro 2005-2006\Cym2005.exe:*:Enabled:Pro Cycling Manager
"C:\Programme\Cyanide\GameCenter\GameCenter.exe" = C:\Programme\Cyanide\GameCenter\GameCenter.exe:*:Enabled:GameCenter -- (Cyanide)
"D:\Programme\Cyanide\GameCenter\GameCenter.exe" = D:\Programme\Cyanide\GameCenter\GameCenter.exe:*:Enabled:GameCenter -- (Cyanide)
"C:\Programme\Yahoo!\Messenger\YahooMessenger.exe" = C:\Programme\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"C:\Programme\Yahoo!\Messenger\YServer.exe" = C:\Programme\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server -- (Yahoo! Inc.)
"C:\Programme\Cyanide\Radsport Manager Pro 2007\PCM.exe" = C:\Programme\Cyanide\Radsport Manager Pro 2007\PCM.exe:*:Enabled:Pro Cycling Manager 2007 -- (Cyanide)
"C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" = C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger -- (Logitech Inc.)
"D:\ICQ6\ICQ.exe" = D:\ICQ6\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, Inc.)
"C:\Programme\KONAMI\Pro Evolution Soccer 2008\PES2008.exe" = C:\Programme\KONAMI\Pro Evolution Soccer 2008\PES2008.exe:*:Enabled:Pro Evolution Soccer 2008
"C:\Programme\Cyanide\Tour de France - Saison 2008\PCM.exe" = C:\Programme\Cyanide\Tour de France - Saison 2008\PCM.exe:*:Enabled:Tour de France - Saison 2008
"C:\Programme\Cyanide\Tour de France - Saison 2008\Autorun\Exe\Autorun.exe" = C:\Programme\Cyanide\Tour de France - Saison 2008\Autorun\Exe\Autorun.exe:*:Enabled:Tour de France - Saison 2008 - AutoRun
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00000407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium
"{01AF4645-78E6-46C4-B528-54863679CC40}" = VAIO SLIT-C Screen Saver
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{11B569C2-4BF6-4ED0-9D17-A4273943CB24}" = Adobe Photoshop Album 2.0 Starter Edition
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1A91D1FA-B9B3-4556-9878-5C61059A19B2}" = InterVideo WinDVDX
"{1BDB9644-5300-4C6A-AFBF-50561DF88151}" = DPM Download/Configuration
"{1EB317D8-8945-4FD6-B37F-DF470317C6AB}" = VAIO Media 3.1
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{266AEE68-5718-4A31-BDD3-D356B1250C70}" = VAIO SLIT Pattern Wallpaper
"{26A24AE4-039D-4CA4-87B4-2F83216010FF}" = Java(TM) 6 Update 15
"{27337663-2619-11D4-99DC-0000F49094C7}" = Memory Stick Formatter
"{27579b3c-5470-4496-be6c-0c872674f19f}" = Macromedia Flash Player
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{2BA722D1-48D1-406E-9123-8AE5431D63EF}" = Windows Live Fotogalerie
"{2FA41EBB-3F5A-35C3-85D6-51EC72A11FBD}" = Google Gears
"{2FFE93F0-BB72-4E52-8761-354D1AAA9387}" = Sony Ericsson PC Suite 4.010.00
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35725FBC-A136-4A46-9F29-091759D9BB93}" = MVision
"{3600FB01-C63B-4A3D-B044-BB21792C6811}" = VAIO SLIT-B Screen Saver
"{364EC092-93CF-4DDC-9D7A-7278452028E0}" = Logitech QuickCam
"{3EAAC5FD-E209-4856-8C49-D4EA40F85032}" = Mobile Connect
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{48820099-ED7D-424B-890C-9A82EF00656D}" = VAIO Update 2
"{48E9DE14-39D1-4974-91A6-D4E1836F648D}" = SafeGuard® PrivateDisk 1.00.6 - Try and Buy Version
"{546CCE4F-3620-47A8-98C9-4D6FD8F311AF}" = x-black LCD
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{582D2A53-F426-4C5E-A2E6-43C1AB36B907}" = Safari
"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6
"{62B715BC-01F5-4CC9-9811-D24ED44C16D4}" = My Info Centre
"{654F0312-CB3D-4FE2-962C-6BB9752E9146}" = iPod for Windows 2005-06-26
"{668B1BD6-4593-4959-970E-249AFFE6F35C}" = VOR
"{685BCC47-B8EC-45EC-BBCE-77DF2451502C}" = DVgate Plus
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6990A2BF-D1D2-11D3-81BC-00609789C908}" = Sony Video Shared Library
"{6A1DC8D4-9FA4-43C3-00B3-5993B4BBE7D4}" = FIFA 2003
"{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6}" = Mobile Phone Manager
"{6F1974D6-4249-43B6-88B0-9A9B8A33956C}" = OpenMG Secure Module 4.0.00
"{7128C69B-8F7E-4336-8698-3FD3CDD955EC}" = VAIO Media Redistribution 3.1
"{7148F0A8-6813-11D6-A77B-00B0D0142050}" = Java 2 Runtime Environment, SE v1.4.2_05
"{71D6CE84-B7DC-4166-8E0D-56C1C37BFB5A}" = SonicStage 2.1.00
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{761C9026-14F0-4352-8658-934558272404}" = VAIO Edit Components
"{76618402-179D-4699-A66B-D351C59436BC}" = Windows Live Sync
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7A79D11B-FD82-4A5E-834F-20173515DD14}" = VAIO Media Integrated Server 3.1
"{7C2F71B2-6C73-11D6-B659-00C04F790F76}" = Click to DVD 2.1.10
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{88DA0A52-3372-4803-971A-ADFB961707E8}" = PictureGear Studio 2.0
"{8A253629-0511-4854-8B4E-46E57E66005C}" = Bonjour
"{8D324F1B-A39E-4D5A-BA58-147416FE019A}" = VAIO SLIT-A Screen Saver
"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
"{9080C5D2-82FA-452A-87FA-CBB4B05D67A5}" = VPS
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD 5 for VAIO
"{936FADC9-C609-471A-B6F2-A33E2E660D1A}" = Sony Notebook Setup
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{98A3A654-3AEF-42D9-BA91-DE5815EA5897}" = Click to DVD 2.0.01 Menüdaten
"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support
"{9E319E96-ED8E-4B01-9775-C521A1869A25}" = VAIO Power Management
"{A17456ED-3432-49FF-A14D-E0F00A96A2AA}" = VAIO SLIT Scene Wallpaper
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43F939E-A863-433D-AC78-0897E44CFEB2}" = VAIO Launcher
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB467B85-4F52-48C2-AEED-0673D00417B0}" = SonicStage Mastering Studio Audio Filter
"{AC5DDE4A-3152-41D7-BECD-41D9B843D22F}" = Vodafone Mobile Connect
"{AC76BA86-7AD7-1031-7B44-A00000000001}" = Adobe Reader 6.0.1 - Deutsch
"{BB311F54-39D6-4A03-8E18-053D1B2833D7}" = HotKey Utility
"{BF3B304B-8A18-452D-A19F-6012CA8418D7}" = SonicStage Mastering Studio 1.3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C79308BC-63CC-4A0F-A585-2E137EA42A1E}_is1" = Power MP4 iPod PSP 3GP AVI MPG WMV Video Converter 8.7
"{C9B59DAD-86AC-456C-80A7-B665E77AA325}" = SigmaTel MSCN Audio Player
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D8E2BDAE-4AEB-464D-A410-89AF090B08D9}" = VAIO GrandBlue Wallpaper
"{D917FD82-6CE5-489A-AAF8-C701AAC85C4D}" = VAIO Entertainment Platform
"{D9F48174-8DEC-4446-B51C-9E57B2FD44D6}" = FIFA 2003 Creation Centre
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{E5E6E687-1031-BA7E-6000-000000000001}" = Acrobat Elements 6.0 - Deutsch
"{E6696A8C-C55A-405C-AFEB-F3880A8BAA45}" = iPod Update 2004-04-28
"{E728E952-DD4F-4BCD-A5C8-40FBFEFF91FE}" = OpenOffice.org Installer 1.0
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{ED8D39F2-7FFA-45EC-B148-EF2472955BB4}" = VAIO Zone
"{EDDDC607-91D9-4758-9F57-265FDCD8A772}" = Microsoft Works 7.0 
"{EE7EB179-5AA2-4B28-AC92-5CBAAF82BA7F}" = SonicStage Mastering Studio Plugins 1.3
"{EF3D45BB-2260-4008-88EA-492E7744A9DF}" = Sony Utilities DLL
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FBEDD989-D0C3-4DF4-A41C-5FC9DD693E18}" = Agatha Christie - Mord im Orient Express
"{FCCB0B43-7A6D-49A4-A5B3-B10F592F4EB6}" = LAN-Express AS IEEE 802.11 Wireless LAN
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 2.0" = Adobe Photoshop Elements 2.0
"Age of Empires 2.0" = Microsoft Age of Empires II
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"ATI Display Driver" = ATI Display Driver
"AviSynth" = AviSynth 2.5
"CNXT_MODEM_PCI_VEN_10B9&DEV_5457&SUBSYS_8175104D" = SoftV92 Data Fax Modem with SmartCP
"Cycling Manager 4" = Radsport Manager 2004/2005
"F1 Pro" = F1 Pro
"GameCenter" = GameCenter
"Google Chrome" = Google Chrome
"GTK 2.0" = GTK+ Runtime 2.14.7 rev a (nur entfernen)
"Hannes Converter" = Hannes Converter 2.0
"InstallShield_{2FDFD600-7338-4738-90D5-FC4ACA08DC36}" = Pro Evolution Soccer 2008
"InstallShield_{546CCE4F-3620-47A8-98C9-4D6FD8F311AF}" = x-black LCD
"InstallShield_{62B715BC-01F5-4CC9-9811-D24ED44C16D4}" = My Info Centre
"InstallShield_{654F0312-CB3D-4FE2-962C-6BB9752E9146}" = iPod for Windows 2005-06-26
"InstallShield_{668B1BD6-4593-4959-970E-249AFFE6F35C}" = VAIO Online-Registration (Deutsch)
"InstallShield_{6BAA26DB-2D4E-42B6-BC3F-3B58144A64B6}" = Mobile Phone Manager
"InstallShield_{6F1974D6-4249-43B6-88B0-9A9B8A33956C}" = OpenMG Secure Module 4.0.00
"InstallShield_{9080C5D2-82FA-452A-87FA-CBB4B05D67A5}" = VAIO Produktumfrage (Deutsch)
"InstallShield_{D9F48174-8DEC-4446-B51C-9E57B2FD44D6}" = FIFA 2003 Creation Centre
"InstallShield_{E6696A8C-C55A-405C-AFEB-F3880A8BAA45}" = iPod Update 2004-04-28
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.4.5 (Standard)
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"MJuiceWinamp" = Mjuice Components
"MM Eisenbahn-Bildschirmschoner V3" = MM Eisenbahn-Bildschirmschoner V3
"MoodLogic" = MoodLogic
"MouseSuite98" = Sony USB Mouse
"Mozilla Firefox (3.5.9)" = Mozilla Firefox (3.5.9)
"MSNINST" = MSN
"My Way Speedbar Uninstall" = My Search Bar
"OpenMG HotFix4.0-04-06-21-01" = OpenMG Limited Patch 4.0-04-07-14-01
"Pidgin" = Pidgin
"Pro Cycling Manager 2007" = Radsport Manager Pro 2007
"QcDrv" = Logitech® Camera-Treiber
"Radsport Manager Pro 2007_is1" = Radsport Manager Pro 2007
"ST6UNST #1" = RaM 2004-2005 Editor
"ToolbarICQToolbar.ICQToolbarObjectIEToolbar" = ICQ  Toolbar
"Ultimate Shirtpack 2007 v1.0" = Ultimate Shirtpack 2007 v1.0
"VLC media player" = VLC media player 0.9.8a
"WIC" = Windows Imaging Component
"WinAce Archiver" = WinAce Archiver
"Winamp" = Winamp (remove only)
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"WinLiveSuite_Wave3" = Windows Live Essentials
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Customizations" = Yahoo! Extras
"Yahoo! Internet Mail" = Yahoo! Internet Mail
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Toolbar" = Yahoo! Toolbar
"YInstHelper" = Yahoo! Install Manager
 
< End of report >

schrauber · 09.07.2014, 16:33

Fixen mit OTL

Starte bitte die OTL.exe.
Kopiere nun den Inhalt aus der Codebox in die Textbox.

Code:

ATTFilter

:OTL
O4 - HKLM..\Run: [FB41AE3B] C:\WINDOWS\system32\windows_32.exe ()
O20 - HKU\Marius_Kals_ON_C Winlogon: Shell - (C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\skype.dat) - C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\skype.dat ()
[2013/05/22 18:37:33 | 000,000,004 | ---- | C] () -- C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\skype.ini
:files
C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\skype.dat
:Commands
[emptytemp]

Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

Rechner normal starten.

badkarmainc · 09.07.2014, 20:39

Hey,

Anbei der neue Log.
Vielen Dank.

Code:

ATTFilter

========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\FB41AE3B deleted successfully.
C:\WINDOWS\system32\windows_32.exe moved successfully.
Registry value HKEY_USERS\Marius_Kals_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\skype.dat deleted successfully.
C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\skype.dat moved successfully.
C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\skype.ini moved successfully.
========== FILES ==========
File\Folder C:\Dokumente und Einstellungen\Marius Kals\Anwendungsdaten\skype.dat not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.
Empty user temp failed. Cannot find local settings folders.
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 48440031 bytes
 
Total Files Cleaned = 46.00 mb
 
 
OTLPE by OldTimer - Version 3.1.48.0 log created on 08292013_160824

schrauber · 10.07.2014, 15:28

Startet der Rechner normal?

badkarmainc · 11.07.2014, 13:42

Hi,

Er startet wieder normal.
Alles funktioniert tadellos.
Habe danach Malwarebytes Anti-Malware laufenlassen und alle Fundsachen entfernt. Zudem auch alle veralteten Treiber etc aktualisiert (das war ja altersbedingt einiges).

Vielen Dank für deine Hilfe!

schrauber · 12.07.2014, 07:44

Gut, dann jetzt Daten sichern und neu aufsetzen.

badkarmainc · 15.07.2014, 13:52

Hi,

So, das hatte jetzt ein wenig gedauert.
Alles funktioniert.

Ich danke dir vielmals!!

Lieben Gruß.

schrauber · 16.07.2014, 10:45

Gern Geschehen

badkarmainc · 26.12.2017, 17:13

Hi,

Wäre es möglich diesen alten Beitrag von mir zu löschen?

Über Google findet sich so noch mein Name (Festplatte hieß so etc).
Oder kann ich das selbst irgendwie löschen?

Vielen Dank für die Hilfe (damals und heute).
Lieben Gruß,
Marius

cosinus · 27.12.2017, 20:12

Alles Relevante dazu wird dort gesagt --> https://www.trojaner-board.de/108423...-anfragen.html

10.07.2014, 15:28	#6
schrauber /// the machine /// TB-Ausbilder	Bundespolizeivirus auf Windows XP - Fix benötigt Startet der Rechner normal? __________________ --> Bundespolizeivirus auf Windows XP - Fix benötigt

12.07.2014, 07:44	#8
schrauber /// the machine /// TB-Ausbilder	Bundespolizeivirus auf Windows XP - Fix benötigt Gut, dann jetzt Daten sichern und neu aufsetzen. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

16.07.2014, 10:45	#10
schrauber /// the machine /// TB-Ausbilder	Bundespolizeivirus auf Windows XP - Fix benötigt Gern Geschehen __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

27.12.2017, 20:12	#12
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Bundespolizeivirus auf Windows XP - Fix benötigt Alles Relevante dazu wird dort gesagt --> https://www.trojaner-board.de/108423...-anfragen.html __________________ Logfiles bitte immer in CODE-Tags posten

Bundespolizeivirus auf Windows XP - Fix benötigt

Log-Analyse und Auswertung: Bundespolizeivirus auf Windows XP - Fix benötigt