| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Stark trojanerverseuchtes System! (Trojan Buzuss, Backdoor Trojan, Trojan Dropper,..)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
08.09.2010, 15:42
| #1 |
| |  Stark trojanerverseuchtes System! (Trojan Buzuss, Backdoor Trojan, Trojan Dropper,..) Hallo! Seit einigen Tagen kämpfe ich mit einigen ziemlich fiesen Problemen: Hatte zuerst Antimalware Doctor - den konnte ich aber nach längerer Zeit mit Hife von Loaris Trojan Remover entfernen (hoffe zumindest, dass er wirklich weg ist). Jetzt habe ich allerdings das Problem, dass 1.) meine Firewall ist ständig deaktiviert ist, auch wenn ich sie wieder aktiviere 2.) ich ständig Warnungen von Avira bekomme (TR/FakeAV.cky, TR/Dropper.Gen, TR.Spy/Gen, BDS/Protector.CF) 3.) bei Suchläufen mit Superantispyware/Spyware Doctor habe ich div. Probleme gefunden: Worm.Palevo, Trojan Buzus, Backdoor Trojan, Trojan Dropper Kill AVGG) konnte diese aber nicht enfernen Bitte dringend um Hilfe! Hier meine OTL-Logfiles:OTL Logfile: Code:
ATTFilter OTL logfile created on: 08.09.2010 16:27:01 - Run 1 OTL by OldTimer - Version 3.2.11.0 Folder = C:\Dokumente und Einstellungen\User1\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy 1.014,00 Mb Total Physical Memory | 474,00 Mb Available Physical Memory | 47,00% Memory free 2,00 Gb Paging File | 2,00 Gb Available in Paging File | 74,00% Paging File free Paging file location(s): C:\pagefile.sys 1524 3048 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 143,13 Gb Total Space | 85,73 Gb Free Space | 59,90% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: *** Current User Name: User1 Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Minimal ========== Processes (SafeList) ========== PRC - C:\Dokumente und Einstellungen\User1\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\PC Tools Security\pctsGui.exe (PC Tools) PRC - C:\Programme\PC Tools Security\BDT\BDTUpdateService.exe (Threat Expert Ltd.) PRC - C:\Programme\PC Tools Security\pctsSvc.exe (PC Tools) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\PC Tools Security\pctsAuxs.exe (PC Tools) PRC - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation) PRC - c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation) PRC - C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe (Sonic Solutions) PRC - C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (Sonic Solutions) PRC - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) PRC - C:\Programme\Digital Line Detect\DLG.exe (BVRP Software) ========== Modules (SafeList) ========== MOD - C:\Dokumente und Einstellungen\User1\Desktop\OTL.exe (OldTimer Tools) MOD - C:\Programme\PC Tools Security\PCTGMhk.dll (PC Tools) MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (sp_rssrv) -- C:\Programme\Spyware Terminator\sp_rsser.exe File not found SRV - (JavaQuickStarterService) -- C:\Programme\Java\jre6\bin\jqs.exe File not found SRV - (Browser Defender Update Service) -- C:\Programme\PC Tools Security\BDT\BDTUpdateService.exe (Threat Expert Ltd.) SRV - (sdCoreService) -- C:\Programme\PC Tools Security\pctsSvc.exe (PC Tools) SRV - (sdAuxService) -- C:\Programme\PC Tools Security\pctsAuxs.exe (PC Tools) SRV - (Apple Mobile Device) -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.) SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ) -- c:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Microsoft Corporation) SRV - (SQLWriter) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation) SRV - (SQLBrowser) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation) SRV - (MSSQLServerADHelper) -- c:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe (Microsoft Corporation) SRV - (odserv) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation) SRV - (BcmSqlStartupSvc) -- C:\Programme\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation) SRV - (RoxMediaDB9) -- C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe (Sonic Solutions) SRV - (RoxWatch9) -- C:\Programme\Gemeinsame Dateien\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe (Sonic Solutions) SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) SRV - (stllssvr) -- C:\Programme\Gemeinsame Dateien\SureThing Shared\stllssvr.exe (MicroVision Development, Inc.) SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation) ========== Driver Services (SafeList) ========== DRV - (sp_rsdrv2) -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys File not found DRV - (PCTCore) -- C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools) DRV - (pctEFA) -- C:\WINDOWS\system32\drivers\pctEFA.sys (PC Tools) DRV - (pctDS) -- C:\WINDOWS\system32\drivers\pctDS.sys (PC Tools) DRV - (SASKUTIL) -- C:\Programme\SUPERAntiSpyware\saskutil.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (SASDIFSV) -- C:\Programme\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (SASENUM) -- C:\Programme\SUPERAntiSpyware\sasenum.sys ( SUPERAdBlocker.com and SUPERAntiSpyware.com) DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (USB_RNDIS) -- C:\WINDOWS\system32\drivers\usb8023.sys (Microsoft Corporation) DRV - (amdagp) -- C:\WINDOWS\system32\DRIVERS\amdagp.sys (Advanced Micro Devices, Inc.) DRV - (sisagp) -- C:\WINDOWS\system32\DRIVERS\sisagp.sys (Silicon Integrated Systems Corporation) DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider) DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation) DRV - (bcm4sbxp) -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation) DRV - (DLADResM) -- C:\WINDOWS\system32\DLA\dladresm.sys (Roxio) DRV - (DLABMFSM) -- C:\WINDOWS\system32\DLA\dlabmfsm.sys (Roxio) DRV - (DLAUDF_M) -- C:\WINDOWS\system32\DLA\dlaudf_m.sys (Roxio) DRV - (DLAUDFAM) -- C:\WINDOWS\system32\DLA\dlaudfam.sys (Roxio) DRV - (DLAOPIOM) -- C:\WINDOWS\system32\DLA\dlaopiom.sys (Roxio) DRV - (DLABOIOM) -- C:\WINDOWS\system32\DLA\dlaboiom.sys (Roxio) DRV - (DLAIFS_M) -- C:\WINDOWS\system32\DLA\dlaifs_m.sys (Roxio) DRV - (DLAPoolM) -- C:\WINDOWS\system32\DLA\dlapoolm.sys (Roxio) DRV - (DRVNDDM) -- C:\WINDOWS\system32\drivers\drvnddm.sys (Roxio) DRV - (DLACDBHM) -- C:\WINDOWS\system32\drivers\DLACDBHM.SYS (Roxio) DRV - (DLARTL_M) -- C:\WINDOWS\system32\drivers\DLARTL_M.SYS (Roxio) DRV - (DRVMCDB) -- C:\WINDOWS\System32\Drivers\DRVMCDB.SYS (Sonic Solutions) DRV - (btaudio) -- C:\WINDOWS\system32\drivers\btaudio.sys (Broadcom Corporation.) DRV - (BTSERIAL) -- C:\WINDOWS\system32\drivers\btserial.sys (Broadcom Corporation.) DRV - (BTKRNL) -- C:\WINDOWS\system32\drivers\btkrnl.sys (Broadcom Corporation.) DRV - (BTDriver) -- C:\WINDOWS\system32\drivers\btport.sys (Broadcom Corporation.) DRV - (btwmodem) -- C:\WINDOWS\system32\drivers\btwmodem.sys (Broadcom Corporation.) DRV - (BTWUSB) -- C:\WINDOWS\system32\drivers\btwusb.sys (Broadcom Corporation.) DRV - (BTWDNDIS) -- C:\WINDOWS\system32\drivers\btwdndis.sys (Broadcom Corporation.) DRV - (btwhid) -- C:\WINDOWS\system32\drivers\btwhid.sys (Broadcom Corporation.) DRV - (STHDA) -- C:\WINDOWS\system32\drivers\sthda.sys (SigmaTel, Inc.) DRV - (SynTP) -- C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.) DRV - (rismxdp) -- C:\WINDOWS\system32\drivers\rixdptsk.sys (REDC) DRV - (rimsptsk) -- C:\WINDOWS\system32\drivers\rimsptsk.sys (REDC) DRV - (rimmptsk) -- C:\WINDOWS\system32\drivers\rimmptsk.sys (REDC) DRV - (APPDRV) -- C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS (Dell Inc) DRV - (HSF_DPV) -- C:\WINDOWS\system32\drivers\hsf_dpv.sys (Conexant Systems, Inc.) DRV - (HSFHWAZL) -- C:\WINDOWS\system32\drivers\hsfhwazl.sys (Conexant Systems, Inc.) DRV - (winachsf) -- C:\WINDOWS\system32\drivers\hsf_cnxt.sys (Conexant Systems, Inc.) DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation) DRV - (omci) -- C:\WINDOWS\system32\drivers\omci.sys (Dell Inc) DRV - (CmdIde) -- C:\WINDOWS\system32\DRIVERS\cmdide.sys (CMD Technology, Inc.) DRV - (Sparrow) -- C:\WINDOWS\system32\DRIVERS\sparrow.sys (Adaptec, Inc.) DRV - (sym_u3) -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys (LSI Logic) DRV - (sym_hi) -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys (LSI Logic) DRV - (symc8xx) -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys (LSI Logic) DRV - (symc810) -- C:\WINDOWS\system32\DRIVERS\symc810.sys (Symbios Logic Inc.) DRV - (ultra) -- C:\WINDOWS\system32\DRIVERS\ultra.sys (Promise Technology, Inc.) DRV - (ql12160) -- C:\WINDOWS\system32\DRIVERS\ql12160.sys (QLogic Corporation) DRV - (ql1080) -- C:\WINDOWS\system32\DRIVERS\ql1080.sys (QLogic Corporation) DRV - (ql1280) -- C:\WINDOWS\system32\DRIVERS\ql1280.sys (QLogic Corporation) DRV - (dac2w2k) -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys (Mylex Corporation) DRV - (mraid35x) -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys (American Megatrends Inc.) DRV - (asc) -- C:\WINDOWS\system32\DRIVERS\asc.sys (Advanced System Products, Inc.) DRV - (asc3550) -- C:\WINDOWS\system32\DRIVERS\asc3550.sys (Advanced System Products, Inc.) DRV - (AliIde) -- C:\WINDOWS\system32\DRIVERS\aliide.sys (Acer Laboratories Inc.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.telekom.at/suche IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\..\URLSearchHook: {472734EA-242A-422b-ADF8-83D1E48CC825} - C:\Programme\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Google" FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=" FF - prefs.js..browser.search.selectedEngine: "Search Defender" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "about:blank" FF - prefs.js..keyword.URL: "hxxp://www.search-results.com/web?o=15868&l=dis&prt=PRT&chn=UN&geo=AT&ver=UN&q=" FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Programme\Java\jre6\lib\deploy\jqs\ff FF - HKLM\software\mozilla\Firefox\extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: C:\Programme\PC Tools Security\BDT\Firefox\ [2010.09.08 14:28:26 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.11\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.09.08 14:08:38 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.11\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.07.23 22:09:14 | 000,000,000 | ---D | M] [2009.03.27 12:38:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\Mozilla\Extensions [2009.10.30 21:28:06 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\Mozilla\Extensions\{2f1e6a90-e99e-11dd-ba2f-0800200c9a66} [2009.03.27 12:38:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\Mozilla\Extensions\mozswing@mozswing.org [2010.09.08 14:59:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\Mozilla\Firefox\Profiles\yqq73l9v.default\extensions [2009.09.02 15:07:25 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\Mozilla\Firefox\Profiles\yqq73l9v.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.09.08 14:56:43 | 000,002,698 | ---- | M] () -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\Mozilla\Firefox\Profiles\yqq73l9v.default\searchplugins\search-defender.xml [2010.09.08 14:59:29 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions O1 HOSTS File: ([2004.08.04 16:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (adShotHlpr Object) - {0E22A371-F8BB-46E7-B732-14EF9FA83F34} - C:\WINDOWS\$NtUninstallMTF196$\mmduch.dll File not found O2 - BHO: (PC Tools Browser Guard BHO) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - C:\Programme\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (moigh Object) - {D65438A0-38C2-475E-93F5-18E645411BB1} - C:\WINDOWS\$NtUninstallMTF196$\adjct.dll File not found O3 - HKLM\..\Toolbar: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (PC Tools Browser Guard) - {472734EA-242A-422B-ADF8-83D1E48CC825} - C:\Programme\PC Tools Security\BDT\PCTBrowserDefender.dll (Threat Expert Ltd.) O4 - HKLM..\Run: [16495] C:\DOKUME~1\User1\LOKALE~1\Temp\3468415.exe File not found O4 - HKLM..\Run: [ISTray] C:\Programme\PC Tools Security\pctsGui.exe (PC Tools) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\BTTray.lnk = C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Digital Line Detect.lnk = C:\Programme\Digital Line Detect\DLG.exe (BVRP Software) O4 - Startup: C:\Dokumente und Einstellungen\User1\Startmenü\Programme\Autostart\LimeWire On Startup.lnk = C:\Programme\LimeWire\LimeWire.exe (Lime Wire, LLC) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\NPJPI150_06.dll (Sun Microsystems, Inc.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.) O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Programme\Gemeinsame Dateien\PC Tools\Lsp\PCTLsp.dll (PC Tools Research Pty Ltd.) O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (DivXBrowserPlugin Object) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06) O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06) O16 - DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab (Java Plug-in 1.6.0_10) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Java Plug-in 1.5.0_06) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138 10.0.0.138 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: TaskMan - (C:\Dokumente und Einstellungen\User1\Anwendungsdaten\ohydy.exe) - C:\Dokumente und Einstellungen\User1\Anwendungsdaten\ohydy.exe (lol lool) O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com) O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\User1\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\User1\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Programme\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004.08.13 14:54:56 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{059c62b8-ff9a-11de-86cf-001d09a57dc0}\Shell\AutoRun\command - "" = E:\wfx062.exe -- File not found O33 - MountPoints2\{059c62b8-ff9a-11de-86cf-001d09a57dc0}\Shell\open\Command - "" = E:\wfx062.exe -- File not found O33 - MountPoints2\{2aa5db88-1087-11dd-bebe-0000caab6328}\Shell\AutoRun\command - "" = E:\wd_windows_tools\setup.exe -- File not found O33 - MountPoints2\{4cffa95e-e04a-11de-8660-0000caab6328}\Shell - "" = AutoRun O33 - MountPoints2\{4cffa95e-e04a-11de-8660-0000caab6328}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{4cffa95e-e04a-11de-8660-0000caab6328}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found O33 - MountPoints2\{68aa3264-b251-11dd-81d8-0000caab6328}\Shell\AutoRun\command - "" = E:\myfolder\myfile.exe -- File not found O33 - MountPoints2\{68aa3264-b251-11dd-81d8-0000caab6328}\Shell\open\command - "" = E:\myfolder\myfile.exe -- File not found O33 - MountPoints2\{a71935c4-ba7c-11df-8930-001d09a57dc0}\Shell\AutoRun\command - "" = wfx062.exe O33 - MountPoints2\{a71935c4-ba7c-11df-8930-001d09a57dc0}\Shell\open\Command - "" = wfx062.exe O33 - MountPoints2\{eb739598-4d12-11df-87f4-001d09a57dc0}\Shell\AutoRun\command - "" = wfx062.exe O33 - MountPoints2\{eb739598-4d12-11df-87f4-001d09a57dc0}\Shell\open\Command - "" = wfx062.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.09.08 16:09:46 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\User1\Desktop\OTL.exe [2010.09.08 15:35:52 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User1\Desktop\MFTools [2010.09.08 15:22:41 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\User1\Recent [2010.09.08 15:10:34 | 000,000,000 | ---D | C] -- C:\Programme\ESET [2010.09.08 15:01:52 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner [2010.09.08 14:47:54 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User1\Lokale Einstellungen\Anwendungsdaten\Threat Expert [2010.09.08 14:28:21 | 000,149,456 | ---- | C] (PC Tools) -- C:\WINDOWS\SGDetectionTool.dll [2010.09.08 14:28:20 | 001,865,680 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDCore.dll [2010.09.08 14:28:20 | 000,739,280 | ---- | C] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDRes.dll [2010.09.08 14:25:22 | 000,656,320 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctEFA.sys [2010.09.08 14:25:22 | 000,338,880 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctDS.sys [2010.09.08 14:25:21 | 000,247,824 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctgntdi.sys [2010.09.08 14:25:02 | 000,237,632 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTCore.sys [2010.09.08 14:25:02 | 000,159,296 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTAppEvent.sys [2010.09.08 14:24:26 | 000,123,968 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctplfw.sys [2010.09.08 14:24:26 | 000,079,672 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctNdis-PacketFilter.sys [2010.09.08 14:24:26 | 000,031,960 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctNdis-DNS.sys [2010.09.08 14:24:25 | 000,070,536 | ---- | C] (PC Tools) -- C:\WINDOWS\System32\drivers\pctplsg.sys [2010.09.08 14:23:29 | 000,000,000 | ---D | C] -- C:\Programme\PC Tools Security [2010.09.08 14:23:29 | 000,000,000 | ---D | C] -- C:\Programme\Gemeinsame Dateien\PC Tools [2010.09.08 14:23:29 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\PC Tools [2010.09.08 14:09:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\QuickScan [2010.09.08 14:02:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Macromedia [2010.09.08 14:02:46 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\Adobe [2010.09.08 10:51:04 | 000,049,265 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\jpicpl32.cpl [2010.09.08 10:47:47 | 000,000,000 | ---D | C] -- C:\Programme\esreicht [2010.09.08 10:44:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt [2010.09.08 10:35:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Tools [2010.09.08 10:26:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss [2010.09.07 17:02:19 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\Malwarebytes [2010.09.07 17:02:05 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010.09.07 17:02:01 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010.09.07 17:02:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2010.09.07 17:02:00 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.09.06 21:53:30 | 000,106,496 | RHS- | C] (lol lool) -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\ohydy.exe [2010.09.06 21:53:04 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\User1\Lokale Einstellungen\Anwendungsdaten\Windows Server [2010.03.11 16:24:42 | 000,535,552 | ---- | C] (Macrovision Corporation) -- C:\Programme\ISSetup.dll ========== Files - Modified Within 30 Days ========== [2010.09.08 16:32:28 | 000,585,504 | ---- | M] () -- C:\WINDOWS\System32\drivers\gdcud.sys [2010.09.08 16:09:48 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\User1\Desktop\OTL.exe [2010.09.08 16:04:00 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010.09.08 16:01:49 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010.09.08 16:01:45 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010.09.08 16:01:43 | 1063,714,816 | -HS- | M] () -- C:\hiberfil.sys [2010.09.08 16:00:24 | 006,029,312 | -H-- | M] () -- C:\Dokumente und Einstellungen\User1\NTUSER.DAT [2010.09.08 15:35:58 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\User1\Desktop\defogger.exe [2010.09.08 15:35:57 | 000,284,915 | ---- | M] () -- C:\Dokumente und Einstellungen\User1\Desktop\Gmer.zip [2010.09.08 15:01:55 | 000,000,654 | ---- | M] () -- C:\Dokumente und Einstellungen\User1\Desktop\CCleaner.lnk [2010.09.08 14:25:45 | 000,701,630 | ---- | M] () -- C:\WINDOWS\System32\drivers\Cat.DB [2010.09.08 14:24:55 | 000,001,614 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Spyware Doctor.lnk [2010.09.08 14:03:25 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\User1\ntuser.ini [2010.09.08 13:42:15 | 004,240,656 | -H-- | M] () -- C:\Dokumente und Einstellungen\User1\Lokale Einstellungen\Anwendungsdaten\IconCache.db [2010.09.08 13:42:10 | 000,000,000 | ---- | M] () -- C:\zrpt.xml [2010.09.08 13:42:05 | 000,086,016 | RHS- | M] () -- C:\WINDOWS\cfdrive32.exe [2010.09.08 13:34:20 | 000,024,576 | ---- | M] () -- C:\lsass.exe [2010.09.08 10:47:53 | 000,000,586 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010.09.08 10:35:52 | 000,000,582 | ---- | M] () -- C:\WINDOWS\win.ini [2010.09.08 10:35:52 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2010.09.08 10:35:52 | 000,000,211 | RHS- | M] () -- C:\boot.ini [2010.09.08 10:13:26 | 000,511,968 | ---- | M] () -- C:\Dokumente und Einstellungen\User1\Desktop\sdsetup_aff.exe [2010.09.08 10:03:04 | 000,001,895 | ---- | M] () -- C:\WINDOWS\lsrslt.ini [2010.09.06 21:53:03 | 000,106,496 | RHS- | M] (lol lool) -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\ohydy.exe [2010.09.06 11:30:04 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2010.09.03 08:57:36 | 000,000,352 | ---- | M] () -- C:\WINDOWS\lexstat.ini [2010.09.03 08:48:01 | 000,002,503 | ---- | M] () -- C:\Dokumente und Einstellungen\User1\Desktop\Microsoft Office Word 2007.lnk [2010.08.30 13:57:02 | 001,865,680 | ---- | M] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDCore.dll [2010.08.30 13:57:02 | 000,739,280 | ---- | M] (Threat Expert Ltd.) -- C:\WINDOWS\PCTBDRes.dll [2010.08.30 13:57:00 | 000,767,952 | ---- | M] () -- C:\WINDOWS\BDTSupport.dll [2010.08.28 11:25:22 | 000,247,824 | ---- | M] (PC Tools) -- C:\WINDOWS\System32\drivers\pctgntdi.sys [2010.08.27 10:13:40 | 000,159,296 | ---- | M] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTAppEvent.sys [2010.08.27 08:26:40 | 000,123,968 | ---- | M] (PC Tools) -- C:\WINDOWS\System32\drivers\pctplfw.sys [2010.08.27 08:26:40 | 000,070,536 | ---- | M] (PC Tools) -- C:\WINDOWS\System32\drivers\pctplsg.sys [2010.08.27 08:25:32 | 000,079,672 | ---- | M] (PC Tools) -- C:\WINDOWS\System32\drivers\pctNdis-PacketFilter.sys [2010.08.26 09:30:28 | 000,002,074 | ---- | M] () -- C:\WINDOWS\UDB.zip [2010.08.23 09:36:38 | 000,149,456 | ---- | M] (PC Tools) -- C:\WINDOWS\SGDetectionTool.dll [2010.08.20 09:50:32 | 000,000,882 | ---- | M] () -- C:\WINDOWS\RegSDImport.xml [2010.08.18 13:51:26 | 000,237,632 | ---- | M] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTCore.sys [2010.08.11 17:18:15 | 000,316,360 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010.08.11 14:44:18 | 001,187,680 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010.08.11 14:44:18 | 000,521,850 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2010.08.11 14:44:18 | 000,492,874 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010.08.11 14:44:18 | 000,110,592 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2010.08.11 14:44:18 | 000,090,894 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010.08.10 16:58:50 | 000,031,960 | ---- | M] (PC Tools) -- C:\WINDOWS\System32\drivers\pctNdis-DNS.sys ========== Files Created - No Company Name ========== [2010.09.08 15:36:36 | 000,293,376 | ---- | C] () -- C:\Dokumente und Einstellungen\User1\Desktop\gmer.exe [2010.09.08 15:35:58 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\User1\Desktop\defogger.exe [2010.09.08 15:35:57 | 000,284,915 | ---- | C] () -- C:\Dokumente und Einstellungen\User1\Desktop\Gmer.zip [2010.09.08 15:01:55 | 000,000,654 | ---- | C] () -- C:\Dokumente und Einstellungen\User1\Desktop\CCleaner.lnk [2010.09.08 14:28:22 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll [2010.09.08 14:28:21 | 000,002,074 | ---- | C] () -- C:\WINDOWS\UDB.zip [2010.09.08 14:28:21 | 000,000,882 | ---- | C] () -- C:\WINDOWS\RegSDImport.xml [2010.09.08 14:28:21 | 000,000,879 | ---- | C] () -- C:\WINDOWS\RegISSImport.xml [2010.09.08 14:28:21 | 000,000,131 | ---- | C] () -- C:\WINDOWS\IDB.zip [2010.09.08 14:25:26 | 000,701,630 | ---- | C] () -- C:\WINDOWS\System32\drivers\Cat.DB [2010.09.08 14:24:55 | 000,001,614 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Spyware Doctor.lnk [2010.09.08 13:43:41 | 1063,714,816 | -HS- | C] () -- C:\hiberfil.sys [2010.09.08 13:34:31 | 000,000,000 | ---- | C] () -- C:\zrpt.xml [2010.09.08 13:34:23 | 000,024,576 | ---- | C] () -- C:\lsass.exe [2010.09.08 13:34:19 | 000,086,016 | RHS- | C] () -- C:\WINDOWS\cfdrive32.exe [2010.09.08 10:35:18 | 000,511,968 | ---- | C] () -- C:\Dokumente und Einstellungen\User1\Desktop\sdsetup_aff.exe [2010.09.07 17:02:08 | 000,000,586 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk [2010.09.07 00:25:39 | 000,001,895 | ---- | C] () -- C:\WINDOWS\lsrslt.ini [2010.08.18 17:47:56 | 000,585,504 | ---- | C] () -- C:\WINDOWS\System32\drivers\gdcud.sys [2010.08.18 17:46:07 | 000,000,012 | ---- | C] () -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\bawuho.dat [2010.05.21 12:45:56 | 000,003,321 | -HS- | C] () -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\020000004abaf473922P.manifest [2010.05.21 12:45:56 | 000,000,013 | -HS- | C] () -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\020000004abaf473922C.manifest [2010.05.21 12:45:56 | 000,000,011 | -HS- | C] () -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\020000004abaf473922S.manifest [2010.05.21 12:45:56 | 000,000,011 | -HS- | C] () -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\020000004abaf473922O.manifest [2010.03.11 16:24:44 | 000,614,857 | ---- | C] () -- C:\Programme\setup.isn [2010.03.11 16:24:44 | 000,585,676 | ---- | C] () -- C:\Programme\setup.inx [2010.03.11 16:24:44 | 000,000,655 | ---- | C] () -- C:\Programme\setup.ini [2010.03.11 16:24:44 | 000,000,493 | ---- | C] () -- C:\Programme\layout.bin [2010.03.11 16:24:44 | 000,000,256 | ---- | C] () -- C:\Programme\lizkey.txt [2010.03.11 16:24:44 | 000,000,158 | ---- | C] () -- C:\Programme\setup.log [2010.03.11 16:22:29 | 888,073,128 | ---- | C] () -- C:\Programme\data2.cab [2010.02.02 18:17:31 | 000,000,036 | ---- | C] () -- C:\Dokumente und Einstellungen\User1\Lokale Einstellungen\Anwendungsdaten\housecall.guid.cache [2009.08.03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll [2008.02.04 18:35:10 | 000,000,352 | ---- | C] () -- C:\WINDOWS\lexstat.ini [2008.02.04 18:34:45 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxbkvs.dll [2008.02.04 18:34:44 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\LXBKLCNP.DLL [2008.02.04 18:34:14 | 000,000,266 | ---- | C] () -- C:\WINDOWS\System32\lxbkcoin.ini [2008.01.20 18:41:36 | 000,000,152 | ---- | C] () -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\AVSDVDPlayer.m3u [2008.01.20 18:40:41 | 000,524,288 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2008.01.20 18:40:41 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2008.01.17 22:29:48 | 000,111,104 | ---- | C] () -- C:\Dokumente und Einstellungen\User1\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.01.17 13:12:11 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\User1\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2008.01.14 12:58:03 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2008.01.14 12:42:40 | 000,198,144 | ---- | C] () -- C:\WINDOWS\System32\_psisdecd.dll [2008.01.14 12:31:27 | 000,056,056 | ---- | C] () -- C:\WINDOWS\System32\DLAAPI_W.DLL [2008.01.14 12:31:27 | 000,000,120 | ---- | C] () -- C:\WINDOWS\wininit.ini [2008.01.14 12:25:53 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\preflib.dll [2008.01.14 12:25:50 | 000,757,760 | ---- | C] () -- C:\WINDOWS\System32\bcm1xsup.dll [2008.01.14 11:49:29 | 000,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll [2008.01.14 11:47:45 | 000,001,504 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2006.11.07 06:25:58 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [2006.09.17 01:36:50 | 000,520,192 | ---- | C] () -- C:\WINDOWS\System32\CddbPlaylist2Roxio.dll [2006.09.17 01:36:50 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\CddbFileTaggerRoxio.dll [2006.05.24 20:16:22 | 000,090,112 | ---- | C] () -- C:\WINDOWS\System32\btprn2k.dll [2005.02.17 14:41:32 | 000,000,603 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest [2005.02.17 14:41:30 | 000,000,593 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest [2004.08.13 15:04:30 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini [2004.08.13 14:51:43 | 000,003,776 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini [2001.11.14 15:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll ========== LOP Check ========== [2008.12.12 11:27:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Fighters [2009.12.30 17:07:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\m2backup [2009.12.30 17:09:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\mquadr.at [2009.12.09 11:42:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Scientific Software [2010.02.02 18:38:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan [2010.03.11 16:56:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SQL Anywhere 10 [2008.01.14 12:42:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SupportSoft [2010.09.08 16:15:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP [2009.12.30 17:00:49 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{39850DC2-6343-4AE6-BC4C-63494A9C369F} [2009.12.30 17:05:15 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{4843418D-E3A6-4662-842A-857DF0C650FB} [2009.12.14 12:59:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{755AC846-7372-4AC8-8550-C52491DAA8BD} [2009.12.30 17:04:54 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{7FDC9DDA-8828-4A49-A615-2E0A4EE0F0E2} [2009.12.30 17:01:00 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{DEC678D1-B2BE-43DD-B123-21503011D8C9} [2008.09.21 16:44:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\gtk-2.0 [2010.09.06 21:04:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\LimeWire [2009.12.30 17:07:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\mquadr.at [2010.09.08 14:15:17 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\QuickScan [2009.10.30 21:28:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\Scendix Software [2009.12.09 11:42:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\User1\Anwendungsdaten\Scientific Software ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 76 bytes -> C:\Dokumente und Einstellungen\User1\Eigene Dateien\Scientific Software:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Dokumente und Einstellungen\User1\Eigene Dateien\Downloads:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Dokumente und Einstellungen\User1\Eigene Dateien\ARIS 7.1:Roxio EMC Stream @Alternate Data Stream - 76 bytes -> C:\Dokumente und Einstellungen\User1\Desktop\MFTools:Roxio EMC Stream @Alternate Data Stream - 145 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2 @Alternate Data Stream - 102 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:430C6D84 < End of report > OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 08.09.2010 16:27:01 - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Dokumente und Einstellungen\User1\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
1.014,00 Mb Total Physical Memory | 474,00 Mb Available Physical Memory | 47,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 74,00% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 143,13 Gb Total Space | 85,73 Gb Free Space | 59,90% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: ***
Current User Name: User1
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htafile [open] -- "%1" %*
htmlfile [edit] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Programme\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\LimeWire\LimeWire.exe" = C:\Programme\LimeWire\LimeWire.exe:*:Enabled:LimeWire -- (Lime Wire, LLC)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"$NtUninstallMTF196$" = Street-Ads Browser Enhancer
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth
"{1ED31028-6D65-4CFD-AD03-8E484A052FE7}" = aonUpdate
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26E1BFB0-E87E-4696-9F89-B467F01F81E5}" = Broadcom Management Programs
"{2F4C24E6-CBD4-4AAC-B56F-C9FD44DE5668}" = Roxio Drag-to-Disc
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3F4EC965-28EF-45C3-B063-04B25D4E9679}" = WIDCOMM Bluetooth Software
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{4767A89A-F6A5-41B1-903C-734483739882}" = Breitband-Internet-Installation
"{498A4E3D-562E-4129-8722-6DCAB12384AE}" = Windows Communication Foundation Language Pack - DEU
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{511E488B-34DD-42EB-8C31-D3C8F21EEFC1}" = ARIS Platform 7.1
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6B7FB3C4-E71B-478D-9E15-5AE97EAD67B8}" = aonFTP
"{7228FD8C-3B9E-4204-AE36-8A466107685B}" = Windows Workflow Foundation DE Language Pack
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{7FB12670-0F93-4E1E-B2F5-4F339199A03A}" = Microsoft SQL Server Native Client
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{849A32C3-E75A-4791-9B11-E568BA3525A4}" = Microsoft SQL Server VSS Writer
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver
"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{9BD40163-B95D-4B07-8991-0AB775B6D88B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{A0516415-ED61-419A-981D-93596DA74165}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_SMALLBUSINESSR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_SMALLBUSINESSR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_SMALLBUSINESSR_{322296D4-1EAE-4030-9FBC-D2787EB25FA2}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_SMALLBUSINESSR_{26454C26-D259-4543-AA60-3189E09C5F76}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{904B64C4-49D8-4941-A2B6-D13D06C5CD8B}" = Controller
"{90A40407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-00CA-0000-0000-0000000FF1CE}" = Microsoft Office Small Business 2007
"{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-00CA-0000-0000-0000000FF1CE}_SMALLBUSINESSR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}" = OutlookAddinSetup
"{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}" = MediaDirect
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6FDF86A-F541-4E7B-AEA0-8849A2A700D5}" = iTunes
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{B06D7A82-E7C6-47D1-97FB-54CA5CA21743}" = ARIS Platform
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B67B329A-8F51-466B-A2C1-E58FFE8F7C33}" = ATLAS.ti Demo
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C5074CC4-0E26-4716-A307-960272A90040}" = QuickSet
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack
"aonFTP" = aonFTP
"aonUpdate" = aonUpdate
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Breitband-Internet-Installation" = Breitband-Internet-Installation
"Broadcom 802.11b Network Adapter" = Dell Wireless WLAN Card
"Browser Defender_is1" = Browser Defender 3.0
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"CCleaner" = CCleaner
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFA&SUBSYS_14F100C3" = Conexant HDA D110 MDC V.92 Modem
"Controller" = Controller
"CTMBDemo_Audigy" = Sound Blaster Audigy ADVANCED MB Demo
"ESET Online Scanner" = ESET Online Scanner v3
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"Lexmark X1100 Series" = Lexmark X1100 Series
"LimeWire" = LimeWire 5.3.6
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"MIXERLITE" = Mixer
"Mozilla Firefox (3.5.11)" = Mozilla Firefox (3.5.11)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Security Task Manager" = Security Task Manager 1.7h
"SMALLBUSINESSR" = Microsoft Office Small Business 2007
"Spyware Doctor" = Spyware Doctor 8.0
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VLC media player" = VideoLAN VLC media player 0.8.6d
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = GIMP 2.4.7
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"OnlineFestplatte" = aon Online Festplatte (entfernen)
========== Last 10 Event Log Errors ==========
[ OSession Events ]
Error - 03.02.2008 11:56:12 | Computer Name = *** | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 26
seconds with 0 seconds of active time. This session ended with a crash.
Error - 05.02.2008 05:19:11 | Computer Name = *** | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 18
seconds with 0 seconds of active time. This session ended with a crash.
Error - 06.02.2008 10:15:42 | Computer Name = *** | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 25
seconds with 0 seconds of active time. This session ended with a crash.
Error - 16.02.2008 06:43:32 | Computer Name = *** | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 18
seconds with 0 seconds of active time. This session ended with a crash.
Error - 25.10.2008 11:27:26 | Computer Name = *** | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:
12.0.6316.5000, Microsoft Office Version: 12.0.6215.1000. This session lasted 169
seconds with 120 seconds of active time. This session ended with a crash.
[ System Events ]
Error - 08.09.2010 09:49:20 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Spyware Terminator Realtime Shield Service" wurde aufgrund
folgenden Fehlers nicht gestartet: %%3
Error - 08.09.2010 09:50:05 | Computer Name = *** | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
sp_rsdrv2
Error - 08.09.2010 09:57:48 | Computer Name = *** | Source = Service Control Manager | ID = 7034
Description = Dienst "PC Tools Auxiliary Service" wurde unerwartet beendet. Dies
ist bereits 1 Mal passiert.
Error - 08.09.2010 09:58:11 | Computer Name = *** | Source = Service Control Manager | ID = 7034
Description = Dienst "Windows-Bilderfassung (WIA)" wurde unerwartet beendet. Dies
ist bereits 1 Mal passiert.
Error - 08.09.2010 09:58:14 | Computer Name = *** | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
von Dienst AntiVirSchedulerService.
Error - 08.09.2010 10:02:03 | Computer Name = *** | Source = Ftdisk | ID = 262189
Description = Das System konnte den Treiber für das Speicherabbild nicht laden.
Error - 08.09.2010 10:02:03 | Computer Name = *** | Source = Ftdisk | ID = 262193
Description = Die Konfiguration der Auslagerungsdatei für das Speicherabbild ist
fehlgeschlagen. Stellen Sie sicher, dass eine Auslagerungsdatei auf der Startpartition
vorhanden ist und dass diese groß genug ist, um den gesamten physikalischen Speicher
abbilden zu können.
Error - 08.09.2010 10:02:57 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Java Quick Starter" wurde aufgrund folgenden Fehlers nicht
gestartet: %%2
Error - 08.09.2010 10:02:57 | Computer Name = *** | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Spyware Terminator Realtime Shield Service" wurde aufgrund
folgenden Fehlers nicht gestartet: %%3
Error - 08.09.2010 10:03:51 | Computer Name = *** | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
sp_rsdrv2
< End of report >
|
|
08.09.2010, 21:12
| #2 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Stark trojanerverseuchtes System! (Trojan Buzuss, Backdoor Trojan, Trojan Dropper,..)Zitat:
Aus den Regeln: 5. Beschreibe Dein Problem in einigen Sätzen und arbeite diese Anleitung ab Punkt 2. durch Auch Funde von deiner Sicherheitssoftware bitte im Thema nennen: (z.B. c:\windows\virus.exe) Fehlen diese Angaben, kann und wird dir hier niemand helfen.
__________________ |
|
09.09.2010, 06:51
| #3 | |
| | Stark trojanerverseuchtes System! (Trojan Buzuss, Backdoor Trojan, Trojan Dropper,..) Oh, sorry...hab ich überlesen. Danke für die Antwort! Hier die fehlenden Angaben:
__________________Zitat:
Wäre sehr dankbar für jede Hilfe! Liebe Grüße |
|
09.09.2010, 12:55
| #4 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Stark trojanerverseuchtes System! (Trojan Buzuss, Backdoor Trojan, Trojan Dropper,..)Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
| Themen zu Stark trojanerverseuchtes System! (Trojan Buzuss, Backdoor Trojan, Trojan Dropper,..) |
| 0x00000001, acroiehelper.dll, alternate, antivir, avgntflt.sys, avira, backdoor, bho, bonjour, browser guard, components, dringend, entfernen, error, excel.exe, fiese, firefox, firefox.exe, google, hijack, hijackthis, limewire, loaris trojan remover, location, microsoft office 2003, microsoft office word, mozilla, object, office 2007, oldtimer, otl logfile, otl.exe, plug-in, registry, rundll, saver, sched.exe, searchplugins, security, security update, senden, server, shell32.dll, software, spyware terminator, system, trojan, trojan buzus, trojan dropper, usb, vlc media player, windows internet, windows internet explorer |
Linear-Darstellung
