Meldung von AVIRA Anitvir:

"In der Datei 'C:\WINDOWS\Temp\TMP24.tmp' wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen3' gefunden.

DerZugriff auf dies Datei wurde verweigert.

bitte wählen Sie die weitere Aktion:


Hilfe

Entfernen Details"

Ende der Meldun von Avira.


Diese Meldung und ähnliche habe ich seit gestern Abend und wenn ich sie mit dem Avira entferne ist es als ob ich mich im Kreis drehe.

Hab irgendwie das gefühl das sich das ding immer kopiert wenn ich es lösche.
Denn das Temp Vezeichnis ist für einen kurzen moment kleiner dann lass ich den avira erneut laufen und hab wieder diesen Trojaner drin.
Die Meldungen der Infizierung sind unterschiedlich es fängt meist mit 2 Funden an geht dann auf 4,10,40,70 und 160 Funde.
Habe sie immer entfernt und fang wieder von vorne an.

Dann hab ich gegoogelt und euer Forum gefunden und hab auch gleich das richtige gefunden. Hab mit der Prozedur angefangen bis OTL+ Fix.
Dann ging es mit Combifix weiter in forumsthema, aber dieses soll man nur starten wenn es von einer Kompetenten Person angewiesen wird.
Würde wenn es geht mein System reinigen und nicht gleich neu aufsetzen wenn es sich vermeiden läst, Ich mach auch Onlinebanking über diesen PC.

So ich hoffe hab nichts vergessen bin das erste mal so in einem Hilfe forum unterwegs.

Vielen Dank im voraus.

Hier der Malwarebytes log:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4746

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

05.10.2010 11:46:58
mbam-log-2010-10-05 (11-46-58).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 383161
Laufzeit: 1 Stunde(n), 52 Minute(n), 18 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


Das TF an 2 von den Logfiles hab ich gemacht als kennung das es für das Forum hier ist.

Hier das Log von OTL.txt

OTL logfile created on: 05.10.2010 16:20:42 - Run 3
OTL by OldTimer - Version 3.2.14.1     Folder = D:\Entpacker\Antivirenprogramme\neu AVProgramme
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 76,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 42,12 Gb Total Space | 29,69 Gb Free Space | 70,50% Space Free | Partition Type: NTFS
Drive D: | 280,03 Gb Total Space | 68,73 Gb Free Space | 24,54% Space Free | Partition Type: NTFS
Drive E: | 50,46 Gb Total Space | 39,58 Gb Free Space | 78,45% Space Free | Partition Type: NTFS
Drive F: | 4,38 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: R-5854B5E9F67C4
Current User Name: ********
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - D:\Entpacker\Antivirenprogramme\neu AVProgramme\OTL.exe (OldTimer Tools)
PRC - d:\Programme\Spyware Terminator\sp_rsser.exe (Crawler.com)
PRC - C:\Programme\cFosSpeed\spd.exe (cFos Software GmbH)
PRC - C:\Programme\cFosSpeed\cfosspeed.exe (cFos Software GmbH)
PRC - d:\Programme\Spyware Doctor\pctsTray.exe (PC Tools)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - d:\Programme\Spyware Doctor\pctsSvc.exe (PC Tools)
PRC - d:\Programme\Spyware Doctor\pctsAuxs.exe (PC Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - D:\Programme\ThreatFire\TFTray.exe (PC Tools)
PRC - d:\Programme\ThreatFire\TFService.exe (PC Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\ASUS\AASP\1.00.95\aaCenter.exe ()
PRC - C:\Programme\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
PRC - D:\Programme\Razer\Arctosa\razerhid.exe (Razer USA Ltd.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - D:\Programme\ASUS\AI Suite\AiNap\AiNap.exe ()
PRC - C:\WINDOWS\LOGI_MWX.EXE (Logitech Inc.)
PRC - C:\WINDOWS\mixer.exe (C-Media Electronic Inc. (www.cmedia.com.tw))
 
 
========== Modules (SafeList) ==========
 
MOD - D:\Entpacker\Antivirenprogramme\neu AVProgramme\OTL.exe (OldTimer Tools)
MOD - d:\Programme\ThreatFire\TFWAH.dll (PC Tools)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Browser Defender Update Service) -- d:\Programme\Spyware Doctor\BDT\BDTUpdateService.exe File not found
SRV - (AppMgmt) -- C:\WINDOWS\System32\appmgmts.dll File not found
SRV - (sp_rssrv) -- d:\Programme\Spyware Terminator\sp_rsser.exe (Crawler.com)
SRV - (Akamai) -- c:\Programme\Gemeinsame Dateien\Akamai\netsession_win_062a651.dll ()
SRV - (cFosSpeedS) -- C:\Programme\cFosSpeed\spd.exe (cFos Software GmbH)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (getPlusHelper) getPlus(R) -- C:\Programme\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
SRV - (TuneUp.Defrag) -- C:\WINDOWS\system32\TuneUpDefragService.exe (TuneUp Software GmbH)
SRV - (sdCoreService) -- d:\Programme\Spyware Doctor\pctsSvc.exe (PC Tools)
SRV - (sdAuxService) -- d:\Programme\Spyware Doctor\pctsAuxs.exe (PC Tools)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ThreatFire) -- d:\Programme\ThreatFire\TFService.exe (PC Tools)
SRV - (LBTServ) -- C:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (UxTuneUp) -- C:\WINDOWS\system32\uxtuneup.dll (TuneUp Software GmbH)
SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (XDva362) -- C:\WINDOWS\System32\XDva362.sys File not found
DRV - (XDva359) -- C:\WINDOWS\System32\XDva359.sys File not found
DRV - (XDva358) -- C:\WINDOWS\System32\XDva358.sys File not found
DRV - (XDva354) -- C:\WINDOWS\System32\XDva354.sys File not found
DRV - (XDva352) -- C:\WINDOWS\System32\XDva352.sys File not found
DRV - (XDva351) -- C:\WINDOWS\System32\XDva351.sys File not found
DRV - (XDva349) -- C:\WINDOWS\System32\XDva349.sys File not found
DRV - (XDva347) -- C:\WINDOWS\System32\XDva347.sys File not found
DRV - (XDva346) -- C:\WINDOWS\System32\XDva346.sys File not found
DRV - (EagleNT) -- C:\WINDOWS\System32\drivers\EagleNT.sys File not found
DRV - (DRHARD) -- C:\WINDOWS\System32\DRIVERS\DRHARD.SYS File not found
DRV - (sp_rsdrv2) -- C:\WINDOWS\system32\drivers\sp_rsdrv2.sys ()
DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)
DRV - (cFosSpeed) -- C:\WINDOWS\system32\drivers\cfosspeed.sys (cFos Software GmbH)
DRV - (PCTCore) -- C:\WINDOWS\system32\drivers\PCTCore.sys (PC Tools)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (TfSysMon) -- C:\WINDOWS\system32\drivers\TfSysMon.sys (PC Tools)
DRV - (TfNetMon) -- C:\WINDOWS\system32\drivers\TfNetMon.sys (PC Tools)
DRV - (TfFsMon) -- C:\WINDOWS\system32\drivers\TfFsMon.sys (PC Tools)
DRV - (JRAID) -- C:\WINDOWS\system32\DRIVERS\jraid.sys (JMicron Technology Corp.)
DRV - (LUsbFilt) -- C:\WINDOWS\system32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LMouFilt) -- C:\WINDOWS\system32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) -- C:\WINDOWS\system32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LBeepKE) -- C:\WINDOWS\system32\drivers\LBeepKE.sys (Logitech, Inc.)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (acedrv11) -- C:\WINDOWS\system32\drivers\acedrv11.sys (Protect Software GmbH)
DRV - (ArcFltr) -- C:\WINDOWS\system32\drivers\Arctosa.sys (Razer USA Ltd.)
DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (AsIO) -- C:\WINDOWS\system32\drivers\AsIO.sys ()
DRV - (ADIHdAudAddService) -- C:\WINDOWS\system32\drivers\ADIHdAud.sys (Analog Devices, Inc.)
DRV - (kbeepm) -- C:\Dokumente und Einstellungen\Spiele\Lokale Einstellungen\Temp\kbeepm.sys ()
DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation                           )
DRV - (SenFiltService) -- C:\WINDOWS\system32\drivers\senfilt.sys (Sensaura)
DRV - (JGOGO) -- C:\WINDOWS\system32\DRIVERS\JGOGO.sys (JMicron )
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\WINDOWS\System32\drivers\sfdrv01.sys (Protection Technology)
DRV - (sfsync02) StarForce Protection Synchronization Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfsync02.sys (Protection Technology)
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\WINDOWS\System32\drivers\sfhlp02.sys (Protection Technology)
DRV - (MTsensor) -- C:\WINDOWS\system32\drivers\ASACPI.sys ()
DRV - (RTL8023) -- C:\WINDOWS\system32\drivers\DLKRTGB.SYS (D-Link Corp.                                                )
DRV - (cmpci) C-Media PCI Audio Driver (WDM) -- C:\WINDOWS\system32\drivers\cmaudio.sys (C-Media Inc)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = hxxp://dnl.crawler.com/support/sa_customize.aspx?TbId=60342
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.crawler.com/search/ie.aspx?tb_id=60342
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.crawler.com/homepage.aspx?tbid=60342
IE - HKCU\..\URLSearchHook: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Crawler Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Crawler Search"
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "hxxp://www.crawler.com/homepage.aspx?tbid=60342"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.2.2
FF - prefs.js..extensions.enabledItems: alaplaya@chibisuke:0.1.2
FF - prefs.js..extensions.enabledItems: {e9911ec6-1bcc-40b0-9993-e0eea7f6953f}:2.5.6.0
FF - prefs.js..extensions.enabledItems: {0b457cAA-602d-484a-8fe7-c1d894a011ba}:0.85
FF - prefs.js..extensions.enabledItems: {1018e4d6-728f-4b20-ad56-37578a4de76b}:4.0.9
FF - prefs.js..extensions.enabledItems: {5C46D283-ABDE-4dce-B83C-08881401921C}:2.1.1
FF - prefs.js..extensions.enabledItems: gutscheinmieze@synatix-gmbh.de:1.04
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {FBF6D7FB-F305-4445-BB3D-FEF66579A033}:5.0
FF - prefs.js..extensions.enabledItems: {1f91cde0-c040-11da-a94d-0800200c9a66}:3.2.2
FF - prefs.js..extensions.enabledItems: {53A03D43-5363-4669-8190-99061B2DEBA5}:1.3.7
FF - prefs.js..extensions.enabledItems: {dc572301-7619-498c-a57d-39143191b318}:0.3.8.4
FF - prefs.js..extensions.enabledItems: tabscope@xuldev.org:0.3.7
FF - prefs.js..extensions.enabledItems: webmynd@yourentirelife.com:1.2
FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.63
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {cb84136f-9c44-433a-9048-c5cd9df1dc16}:2.0.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {4B3803EA-5230-4DC3-A7FC-33638F3D3542}:1.3
 
 
FF - HKLM\software\mozilla\Firefox\extensions\\{cb84136f-9c44-433a-9048-c5cd9df1dc16}: d:\Programme\Spyware Doctor\BDT\FireFox\ [2010.06.29 12:15:25 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{4B3803EA-5230-4DC3-A7FC-33638F3D3542}: C:\Programme\Crawler\Toolbar\firefox\ [2010.10.04 23:47:48 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.09.22 02:05:41 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.09.17 07:41:26 | 000,000,000 | ---D | M]
 
[2009.12.25 17:13:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Extensions
[2010.10.05 10:03:11 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions
[2010.10.05 09:34:28 | 000,000,000 | ---D | M] (FireShot) -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2010.10.05 09:34:30 | 000,000,000 | ---D | M] (Flagfox) -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2010.10.05 09:34:25 | 000,000,000 | ---D | M] (RSS Ticker) -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions\{1f91cde0-c040-11da-a94d-0800200c9a66}
[2010.03.29 08:29:26 | 000,000,000 | ---D | M] (ScrapBook) -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions\{53A03D43-5363-4669-8190-99061B2DEBA5}
[2010.10.05 09:34:22 | 000,000,000 | ---D | M] (Google Shortcuts) -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions\{5C46D283-ABDE-4dce-B83C-08881401921C}
[2010.10.05 09:34:29 | 000,000,000 | ---D | M] (WOT) -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2010.10.05 09:34:27 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010.06.29 12:19:11 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions\{dc572301-7619-498c-a57d-39143191b318}
[2010.04.14 14:49:26 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
[2010.02.08 09:51:46 | 000,000,000 | ---D | M] (DVDVideoSoft Toolbar) -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}
[2010.10.05 09:34:22 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions\{FBF6D7FB-F305-4445-BB3D-FEF66579A033}
[2009.12.25 23:57:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions\alaplaya@chibisuke
[2010.10.05 09:34:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions\foxmarks@kei.com
[2010.02.11 10:35:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions\gutscheinmieze@synatix-gmbh.de
[2010.10.05 09:34:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions\tabscope@xuldev.org
[2010.10.05 09:34:44 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\extensions\webmynd@yourentirelife.com
[2009.12.25 22:10:31 | 000,000,873 | ---- | M] () -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Mozilla\Firefox\Profiles\8a4475rp.default\searchplugins\conduit.xml
[2010.10.05 10:03:12 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions
[2010.04.20 14:47:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.03 16:16:24 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.01.14 00:46:00 | 000,063,488 | ---- | M] (Nullsoft, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npwachk.dll
[2010.07.02 18:51:19 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2009.09.21 12:24:16 | 000,001,329 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\crawlersrch.xml
[2010.07.02 18:51:19 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.07.02 18:51:19 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.07.02 18:51:19 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.07.02 18:51:19 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.02.28 14:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: () - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com)
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O2 - BHO: (no name) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - No CLSID value found.
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVD0.dll (Conduit Ltd.)
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVD0.dll (Conduit Ltd.)
O2 - BHO: (EpsonToolBandKicker Class) - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKLM\..\Toolbar: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKLM\..\Toolbar: (&Crawler Toolbar) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Programme\DVDVideoSoftTB\tbDVD0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKLM\..\Toolbar: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Gutscheinmieze\toolbar.dll (Synatix GmbH)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Programme\DVDVideoSoft\tbDVD0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKLM\..\Toolbar: (EPSON Web-To-Page) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\epson\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Gutscheinmieze) - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} - C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Gutscheinmieze\toolbar.dll (Synatix GmbH)
O3 - HKCU\..\Toolbar\WebBrowser: (DVDVideoSoftTB Toolbar) - {E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} - C:\Programme\DVDVideoSoft\tbDVD0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Programme\Winamp Toolbar\winamptb.dll (AOL LLC.)
O4 - HKLM..\Run: [36X Raid Configurer] C:\WINDOWS\System32\xRaidSetup.exe (JMicron Technology Corp.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Ai Nap] d:\Programme\ASUS\AI Suite\AiNap\AiNap.exe ()
O4 - HKLM..\Run: [Arctosa] d:\Programme\Razer\Arctosa\razerhid.exe (Razer USA Ltd.)
O4 - HKLM..\Run: [ASUS Energy Saving] d:\Programme\ASUS\AI Suite\EnergySaving\PwSave.exe ()
O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [cFosSpeed] C:\Programme\cFosSpeed\cfosspeed.exe (cFos Software GmbH)
O4 - HKLM..\Run: [C-Media Mixer] C:\WINDOWS\mixer.exe (C-Media Electronic Inc. (www.cmedia.com.tw))
O4 - HKLM..\Run: [Cpu Level Up help] d:\Programme\ASUS\AI Suite\CpuLevelUpHelp.exe ()
O4 - HKLM..\Run: [CPU Power Monitor] d:\Programme\ASUS\AI Suite\AiGear3\CpuPowerMonitor.exe ()
O4 - HKLM..\Run: [EEventManager] C:\Programme\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe ()
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Logitech Utility] C:\WINDOWS\LOGI_MWX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Programme\NVIDIA Corporation\nView\nwiz.exe ()
O4 - HKLM..\Run: [SpywareTerminator] D:\Programme\Spyware Terminator\SpywareTerminatorShield.exe (Crawler.com)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [ThreatFire] d:\Programme\ThreatFire\TFTray.exe (PC Tools)
O4 - HKCU..\Run: [EPSON SX110 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIFBE.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [FilterHost] C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\mmserver\FilterHost.exe (Synatix GmbH)
O4 - HKCU..\Run: [SpywareTerminatorUpdate] D:\Programme\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
O4 - HKCU..\Run: [TuneUp MemOptimizer] D:\Programme\TuneUp Utilities 2008\MemOptimizer.exe (TuneUp Software GmbH)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\InstantTimeZone.lnk = D:\Programme\InstantTimeZone\InstantTimeZone.exe (THe UDS)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Logitech SetPoint.lnk = D:\Programme\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\wolverin\Startmenü\Programme\Autostart\Logitech . Produktregistrierung.lnk = C:\Programme\Gemeinsame Dateien\Logishrd\eReg\SetPoint\eReg.exe (Leader Technologies/Logitech)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\tbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\Programme\Crawler\Toolbar\ctbr.dll (Crawler.com)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UIHost - (C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe) - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe (Microsoft Corporation)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\programme\gemeinsame dateien\logishrd\bluetooth\LBTWlgn.dll - c:\Programme\Gemeinsame Dateien\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\wolverin\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\wolverin\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.12.25 15:57:25 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2008.05.18 00:27:40 | 000,000,000 | ---D | M] - D:\Autorun -- [ NTFS ]
O32 - AutoRun File - [2007.11.29 06:35:54 | 000,995,328 | R--- | M] () - F:\AutoPlay.exe -- [ UDF ]
O32 - AutoRun File - [2007.12.05 01:30:17 | 000,002,072 | R--- | M] () - F:\autoplay.ini -- [ UDF ]
O32 - AutoRun File - [2007.12.05 20:46:15 | 000,000,878 | R--- | M] () - F:\AutoPlay.ucs -- [ UDF ]
O32 - AutoRun File - [2007.11.29 06:35:54 | 000,576,056 | R--- | M] () - F:\AutoRun.bmp -- [ UDF ]
O32 - AutoRun File - [2007.11.29 06:36:01 | 000,000,049 | R--- | M] () - F:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{e86e896c-f160-11de-be02-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{e86e896c-f160-11de-be02-806d6172696f}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e86e896c-f160-11de-be02-806d6172696f}\Shell\AutoRun\command - "" = G:\Bin\Assetup.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.10.05 09:31:25 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Malwarebytes
[2010.10.05 09:24:59 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Spyware Terminator
[2010.10.05 01:15:31 | 000,000,000 | ---D | C] -- C:\Programme\WinClamAVShield
[2010.10.04 23:46:20 | 000,000,000 | ---D | C] -- C:\Programme\Crawler
[2010.10.04 23:45:18 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spyware Terminator
[2010.10.04 21:20:02 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010.10.04 21:20:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
[2010.10.04 21:20:00 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010.10.01 12:53:08 | 000,000,000 | ---D | C] -- C:\Programme\OpenAL
[2010.10.01 12:53:07 | 000,444,952 | ---- | C] (Creative Labs) -- C:\WINDOWS\System32\wrap_oal.dll
[2010.10.01 12:53:07 | 000,109,080 | ---- | C] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\WINDOWS\System32\OpenAL32.dll
[2010.09.30 12:02:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2010.09.30 09:38:17 | 000,000,000 | ---D | C] -- C:\Programme\14 East
[2010.09.30 08:58:01 | 000,000,000 | ---D | C] -- C:\Programme\Mplayer
[2010.09.30 08:55:09 | 000,328,704 | ---- | C] (InstallShield Software Corporation ) -- C:\WINDOWS\IsUn0407.exe
[2010.09.15 05:00:08 | 000,000,000 | ---D | C] -- C:\Programme\directx
[2010.09.06 18:59:36 | 000,059,888 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxwma.dll
[2004.11.24 20:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll
 
========== Files - Modified Within 30 Days ==========
 
[2010.10.05 16:14:49 | 003,670,016 | ---- | M] () -- C:\Dokumente und Einstellungen\wolverin\NTUSER.DAT
[2010.10.05 16:00:01 | 000,000,498 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job
[2010.10.05 09:35:30 | 101,500,984 | ---- | M] () -- C:\Dokumente und Einstellungen\wolverin\Eigene Dateien\Standard_20101005_093450.zip
[2010.10.05 09:25:32 | 000,000,961 | ---- | M] () -- C:\Dokumente und Einstellungen\wolverin\Startmenü\Programme\Autostart\Logitech . Produktregistrierung.lnk
[2010.10.05 09:24:57 | 000,013,104 | ---- | M] () -- C:\Dokumente und Einstellungen\wolverin\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
[2010.10.05 08:57:42 | 003,861,166 | ---- | M] () -- C:\Dokumente und Einstellungen\wolverin\Desktop\CofiFix.exe
[2010.10.05 08:43:55 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010.10.05 08:43:53 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.10.05 08:43:46 | 000,095,072 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.10.05 07:57:37 | 000,000,100 | ---- | M] () -- C:\WINDOWS\Sfc3ng.ini
[2010.10.04 23:49:43 | 000,000,637 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Spyware Terminator.lnk
[2010.10.04 23:45:19 | 000,142,592 | ---- | M] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2010.10.04 21:20:05 | 000,000,554 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.10.04 17:08:09 | 000,107,888 | ---- | M] (Sony DADC Austria AG.) -- C:\WINDOWS\System32\CmdLineExt.dll
[2010.10.02 15:12:52 | 000,000,698 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Soulstorm.lnk
[2010.10.01 17:22:36 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.10.01 14:48:42 | 000,000,613 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Demo von Sid Meier’s Civilization 4 starten.lnk
[2010.10.01 12:53:08 | 000,444,952 | ---- | M] (Creative Labs) -- C:\WINDOWS\System32\wrap_oal.dll
[2010.10.01 12:53:07 | 000,109,080 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\WINDOWS\System32\OpenAL32.dll
[2010.10.01 08:04:24 | 000,000,211 | ---- | M] () -- C:\Dokumente und Einstellungen\wolverin\Desktop\Sid Meier's Civilization V - Demo.url
[2010.09.30 13:07:39 | 000,000,101 | ---- | M] () -- C:\WINDOWS\CMMIXER.INI
[2010.09.30 12:45:41 | 000,000,507 | ---- | M] () -- C:\WINDOWS\win.ini
[2010.09.30 12:45:41 | 000,000,389 | RHS- | M] () -- C:\boot.ini
[2010.09.30 12:45:41 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010.09.20 08:47:31 | 000,001,978 | ---- | M] () -- C:\Dokumente und Einstellungen\wolverin\Eigene Dateien\Lebenslauf - Sascha.doc
[2010.09.19 21:20:09 | 000,000,190 | -HS- | M] () -- C:\Dokumente und Einstellungen\wolverin\ntuser.ini
 
========== Files Created - No Company Name ==========
 
[2010.10.05 09:35:05 | 101,500,984 | ---- | C] () -- C:\Dokumente und Einstellungen\wolverin\Eigene Dateien\Standard_20101005_093450.zip
[2010.10.05 09:28:12 | 003,861,166 | ---- | C] () -- C:\Dokumente und Einstellungen\wolverin\Desktop\CofiFix.exe
[2010.10.05 09:25:32 | 000,000,961 | ---- | C] () -- C:\Dokumente und Einstellungen\wolverin\Startmenü\Programme\Autostart\Logitech . Produktregistrierung.lnk
[2010.10.04 23:49:43 | 000,000,637 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Spyware Terminator.lnk
[2010.10.04 23:45:20 | 000,142,592 | ---- | C] () -- C:\WINDOWS\System32\drivers\sp_rsdrv2.sys
[2010.10.04 21:20:05 | 000,000,554 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2010.10.02 15:12:52 | 000,000,698 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Soulstorm.lnk
[2010.10.01 14:48:42 | 000,000,613 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Demo von Sid Meier’s Civilization 4 starten.lnk
[2010.10.01 08:04:24 | 000,000,211 | ---- | C] () -- C:\Dokumente und Einstellungen\wolverin\Desktop\Sid Meier's Civilization V - Demo.url
[2010.09.30 12:45:40 | 000,000,616 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\InstantTimeZone.lnk
[2010.09.30 10:31:21 | 000,000,100 | ---- | C] () -- C:\WINDOWS\Sfc3ng.ini
[2010.09.20 08:47:31 | 000,001,978 | ---- | C] () -- C:\Dokumente und Einstellungen\wolverin\Eigene Dateien\Lebenslauf - Sascha.doc
[2010.08.30 01:39:32 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2010.08.30 01:39:32 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2010.08.30 01:39:32 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2010.08.30 01:35:35 | 000,000,214 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2010.04.10 21:59:51 | 000,000,101 | ---- | C] () -- C:\WINDOWS\CMMIXER.INI
[2010.04.10 21:56:06 | 000,000,025 | ---- | C] () -- C:\WINDOWS\mixerdef.ini
[2010.04.10 20:42:20 | 000,013,635 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2010.03.29 11:05:38 | 000,000,000 | ---- | C] () -- C:\WINDOWS\EEventManager.INI
[2010.03.29 08:19:40 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2010.03.07 08:42:36 | 000,011,832 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp64.sys
[2010.03.07 08:42:36 | 000,010,216 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp32.sys
[2010.01.06 22:42:23 | 000,001,769 | ---- | C] () -- C:\WINDOWS\Language_trs.ini
[2010.01.06 22:35:25 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\AsIO.dll
[2010.01.06 22:35:25 | 000,012,400 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsIO.sys
[2009.12.28 02:29:29 | 000,819,200 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009.12.28 02:29:29 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009.12.26 11:01:53 | 000,767,952 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll.old
[2009.12.26 11:01:53 | 000,767,928 | ---- | C] () -- C:\WINDOWS\BDTSupport.dll
[2009.12.25 17:52:15 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2009.12.25 17:45:09 | 000,000,000 | ---- | C] () -- C:\WINDOWS\oodcnt.INI
[2009.12.25 16:23:33 | 000,013,887 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini
[2009.12.25 16:21:58 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2009.12.25 16:21:48 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009.12.25 16:10:23 | 000,012,288 | ---- | C] () -- C:\Dokumente und Einstellungen\wolverin\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.12.19 16:15:58 | 004,338,246 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll
[2008.12.17 18:41:18 | 000,884,237 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll
[2008.12.17 18:22:58 | 000,093,184 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll
[2008.12.17 18:22:48 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2008.12.17 18:17:34 | 000,239,247 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll
[2008.12.17 17:59:54 | 000,560,802 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll
[2008.12.11 12:27:02 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2004.10.03 18:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll
 
========== LOP Check ==========
 
[2009.12.26 12:37:03 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CCP
[2010.03.29 08:25:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON
[2010.07.17 00:17:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PMB Files
[2010.10.05 16:04:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spyware Terminator
[2009.12.25 20:56:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-Online
[2010.10.05 16:19:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
[2010.03.17 08:10:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
[2010.03.29 08:24:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\UDL
[2010.04.10 09:31:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Daoisoft
[2010.03.29 10:45:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Epson
[2010.01.15 20:03:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\EVEMon
[2009.12.25 20:43:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\FireShot
[2010.02.11 10:35:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Gutscheinmieze
[2009.12.25 19:47:36 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Leadertech
[2010.02.11 10:35:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\mmserver
[2010.06.25 22:16:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Petroglyph
[2010.07.11 13:10:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\PriceGong
[2010.10.05 16:05:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\Spyware Terminator
[2009.12.25 21:00:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\T-Online
[2009.12.25 17:55:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\wolverin\Anwendungsdaten\TuneUp Software
[2010.10.05 16:00:01 | 000,000,498 | ---- | M] () -- C:\WINDOWS\Tasks\1-Klick-Wartung.job
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 162 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:DFC5A2B2
@Alternate Data Stream - 127 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:D06A4C76
@Alternate Data Stream - 117 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:A8ADE5D8
@Alternate Data Stream - 105 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:430C6D84
< End of report >
         

OTL Log Extra.txt

OTL Extras logfile created on: 05.10.2010 16:20:42 - Run 3
OTL by OldTimer - Version 3.2.14.1     Folder = D:\Entpacker\Antivirenprogramme\neu AVProgramme
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 76,00% Memory free
5,00 Gb Paging File | 4,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 42,12 Gb Total Space | 29,69 Gb Free Space | 70,50% Space Free | Partition Type: NTFS
Drive D: | 280,03 Gb Total Space | 68,73 Gb Free Space | 24,54% Space Free | Partition Type: NTFS
Drive E: | 50,46 Gb Total Space | 39,58 Gb Free Space | 78,45% Space Free | Partition Type: NTFS
Drive F: | 4,38 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: R-5854B5E9F67C4
Current User Name: ********
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "d:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "d:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "D:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "D:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "D:\Programme\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 4
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"58014:TCP" = 58014:TCP:*:Enabled:Pando Media Booster
"58014:UDP" = 58014:UDP:*:Enabled:Pando Media Booster
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"58014:TCP" = 58014:TCP:*:Enabled:Pando Media Booster
"58014:UDP" = 58014:UDP:*:Enabled:Pando Media Booster
"8394:TCP" = 8394:TCP:*:Enabled:League of Legends Launcher
"8394:UDP" = 8394:UDP:*:Enabled:League of Legends Launcher
"3724:TCP" = 3724:TCP:*:Enabled:Blizzard Downloader: 3724
"6899:TCP" = 6899:TCP:*:Enabled:League of Legends Launcher
"6899:UDP" = 6899:UDP:*:Enabled:League of Legends Launcher
"6960:TCP" = 6960:TCP:*:Enabled:League of Legends Launcher
"6960:UDP" = 6960:UDP:*:Enabled:League of Legends Launcher
"1033:TCP" = 1033:TCP:*:Enabled:Akamai NetSession Interface
"5000:UDP" = 5000:UDP:*:Enabled:Akamai NetSession Interface
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"D:\Programme\THQ\Dawn of War - Dark Crusade\DarkCrusade.exe" = D:\Programme\THQ\Dawn of War - Dark Crusade\DarkCrusade.exe:*:Enabled:DarkCrusade -- (THQ Canada Inc.)
"D:\Programme\CCP\EVE\bin\ExeFile.exe" = D:\Programme\CCP\EVE\bin\ExeFile.exe:*:Enabled:CCP ExeFile -- (CCP hf.)
"D:\Programme\CCP\EVE\eve.exe" = D:\Programme\CCP\EVE\eve.exe:*:Enabled:Play EVE -- (CCP hf.)
"D:\Programme\Cryptic Studios\Star Trek Online.exe" = D:\Programme\Cryptic Studios\Star Trek Online.exe:*:Enabled:Star Trek Online -- ()
"D:\Programme\World of Warcraft\Launcher.exe" = D:\Programme\World of Warcraft\Launcher.exe:*:Enabled:Launcher.exe -- (Blizzard Entertainment)
"D:\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-deDE-downloader.exe" = D:\World of Warcraft\WoW-3.2.0.10192-to-3.2.0.10314-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"D:\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-deDE-downloader.exe" = D:\World of Warcraft\WoW-3.1.3.9947-to-3.2.0.10192-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"D:\World of Warcraft\Launcher.exe" = D:\World of Warcraft\Launcher.exe:*:Enabled:Blizzard Launcher -- (Blizzard Entertainment)
"D:\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-deDE-downloader.exe" = D:\World of Warcraft\WoW-3.2.0.10314-to-3.2.2.10482-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"D:\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-deDE-downloader.exe" = D:\World of Warcraft\WoW-3.2.2.10482-to-3.2.2.10505-deDE-downloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"D:\World of Warcraft\Repair.exe" = D:\World of Warcraft\Repair.exe:*:Enabled:Blizzard Repair Utility -- (Blizzard Entertainment, Inc.)
"C:\Programme\Epson Software\Event Manager\EEventManager.exe" = C:\Programme\Epson Software\Event Manager\EEventManager.exe:*:Enabled:EEventManager Application -- (SEIKO EPSON CORPORATION)
"D:\Programme\alaplaya\S4League\patcher_s4.exe" = D:\Programme\alaplaya\S4League\patcher_s4.exe:*:Enabled:S4League -- ((c) Neowiz Games)
"D:\Programme\TrueGames\Warrior Epic\launcher.ui.exe" = D:\Programme\TrueGames\Warrior Epic\launcher.ui.exe:*:Enabled:Warrior Epic Launcher -- (Solid State Networks)
"D:\Programme\TrueGames\Warrior Epic\WEShell_TGI.exe" = D:\Programme\TrueGames\Warrior Epic\WEShell_TGI.exe:*:Enabled:Warrior Epic Client -- (True Games Interactive)
"D:\Programme\LucasArts\Star Wars Empire at War\GameData\sweaw.exe" = D:\Programme\LucasArts\Star Wars Empire at War\GameData\sweaw.exe:*:Enabled:Star Wars: Empire at War -- (Lucasfilm Entertainment Company, Ltd.)
"D:\Programme\LucasArts\Star Wars Empire at War\GameData\fpupdate.exe" = D:\Programme\LucasArts\Star Wars Empire at War\GameData\fpupdate.exe:*:Enabled:fpupdate -- ()
"C:\Programme\Pando Networks\Media Booster\PMB.exe" = C:\Programme\Pando Networks\Media Booster\PMB.exe:*:Enabled:Pando Media Booster -- ()
"D:\Programme\League of Legends\Air\LolClient.exe" = D:\Programme\League of Legends\Air\LolClient.exe:*:Enabled:League of Legends Lobby -- ()
"D:\Programme\League of Legends\Game\League of Legends.exe" = D:\Programme\League of Legends\Game\League of Legends.exe:*:Enabled:League of Legends Game Client -- ()
"D:\Sierra\Empire Earth\Empire Earth.exe" = D:\Sierra\Empire Earth\Empire Earth.exe:*:Enabled:Empire Earth -- ()
"D:\Programme\World of Warcraft\BackgroundDownloader.exe" = D:\Programme\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader -- (Blizzard Entertainment)
"D:\Programme\Steam\steamapps\common\sid meier's civilization v - demo\Launcher.exe" = D:\Programme\Steam\steamapps\common\sid meier's civilization v - demo\Launcher.exe:*:Enabled:Sid Meier's Civilization V - Demo -- (Firaxis Games)
"D:\Programme\Steam\steamapps\common\sid meier's civilization v - demo\CivilizationV.exe" = D:\Programme\Steam\steamapps\common\sid meier's civilization v - demo\CivilizationV.exe:*:Enabled:Sid Meier's Civilization V - Demo -- (Firaxis Games)
"D:\Programme\Spyware Terminator\SpywareTerminator.exe" = D:\Programme\Spyware Terminator\SpywareTerminator.exe:*:Enabled:Spyware Terminator -- (Crawler.com)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0049D352-1D20-4FFB-8EF6-81CFBDF3ADE5}" = Soul of the Ultimate Nation
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{1E99F5D7-4262-4C7C-9135-F066E7485811}" = System Requirements Lab
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20533183-D42D-4261-A125-956736FBEA8C}" = Dawn of War - Soulstorm
"{2447500B-22D7-47BD-9B13-1A927F43A267}" = Empire Earth
"{255FC1CF-2620-4B64-BE02-79B9E609BB3D}" = Webzen Game Starter
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 21
"{287A4E96-AC57-4A19-9B51-C5EED2EAB382}" = Star Trek Legacy
"{2A241A64-9AD1-4D94-A227-6C3D5D2F854D}" = Sid Meier's Civilization 4 Demo
"{2D9C81F2-CF30-47F9-860E-58DACF92ABC9}" = Razer Arctosa
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{310BC5E2-31AF-49BB-904D-E71EB93645DC}" = AI Suite
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}" = JMicron JMB36X Driver
"{48F22622-1CC2-4A83-9C1E-644DD96F832D}" = Epson Event Manager
"{498A4E3D-562E-4129-8722-6DCAB12384AE}" = Windows Communication Foundation Language Pack - DEU
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{57015988-7E53-4190-A0CF-A9B3E5CE29E5}" = S4 League_EU
"{5809E7CF-4DCF-11D4-9875-00105ACE7734}" = Logitech MouseWare 9.80 
"{5888428E-699C-4E71-BF71-94EE06B497DA}" = TuneUp Utilities 2008
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{7228FD8C-3B9E-4204-AE36-8A466107685B}" = Windows Workflow Foundation DE Language Pack
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7F14F68C-17FA-4F88-B3FD-7F449C1EBF32}" = EPSON Web-To-Page
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{87C2248A-C7DD-49ED-9BCD-B312A9D0819E}" = Epson Easy Photo Print 2
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{92482FB3-C05B-41C6-89E7-75D985602A6E}" = System Requirements Lab
"{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}" = Windows Presentation Foundation Language Pack (DEU)
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{99AE7207-8612-4DBA-A8F8-BAE5C633390D}" = Star Wars Empire at War
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A2B3C27C-1F09-47C6-9A90-9683BEFD7963}" = Dawn of War - Soulstorm
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.4 - Deutsch
"{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}" = ABBYY FineReader 6.0 Sprint
"{B1275E23-717A-4D52-997A-1AD1E24BC7F3}" = T-Online 6.0
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B4F3A360-E1E2-479D-ADE7-9BE3B07F4539}" = NVIDIA PhysX
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Plus Web Player
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C7E9FB5B-626B-49D9-A99C-7BFA63C222D3}" = Railroad Tycoon II - Platinum
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F2A7F421-1679-48D5-B918-96999014ED53}" = Microsoft .NET Framework 3.0 German Language Pack
"{F7338FA3-DAB5-49B2-900D-0AFB5760C166}" = PC Probe II
"{FBBFABCD-E075-457B-A70B-CF40C66CF033}" = Sid Meier's Civilization 4 Demo
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"3554AA4B-9B0B-451a-A269-2B5F53982209_is1" = ThreatFire
"AC3Filter_is1" = AC3Filter 1.62b
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Akamai" = Akamai NetSession Interface
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Blitzkrieg" = Blitzkrieg
"Browser Defender_is1" = Browser Defender 3.0.0.11
"CCleaner" = CCleaner
"C-evo" = C-evo
"cFosSpeed" = cFosSpeed v5.12
"CToolbar_UNINSTALL" = Crawler Toolbar with Web Security Guard
"DBBD4687DB2530A2F7D7FAB13E7DF67638CCA3B9" = Windows Driver Package - Razer (HidUsb) HIDClass  (01/11/2007 1.0)
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Dr. Hardware 2010_is1" = Dr. Hardware 2010 10.2d
"DVDVideoSoft Toolbar" = DVDVideoSoft Toolbar
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"EPSON Scanner" = EPSON Scan
"Epson Stylus SX110_TX110 Benutzerhandbuch" = Epson Stylus SX110_TX110 Handbuch
"EPSON SX110 Series" = EPSON SX110 Series Printer Uninstall
"EVE" = EVE Online (remove only)
"EVEMon" = EVEMon
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.7
"Gutscheinmieze - Toolbar" = Gutscheinmieze - Toolbar
"InstantTimeZone" = InstantTimeZone
"League of Legends_is1" = League of Legends
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.0 German Language Pack" = Microsoft .NET Framework 3.0 German Language Pack
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"Mplayer.com" = Mplayer.com
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"myGamersCam" = myGamersCam 1.4
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"OpenAL" = OpenAL
"PCI Audio Driver" = PCI Audio Driver
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"Revo Uninstaller" = Revo Uninstaller 1.85
"Spyware Doctor" = Spyware Doctor 7.0
"Spyware Terminator_is1" = Spyware Terminator
"Star Trek Online" = Star Trek Online
"Steam App 65900" = Sid Meier's Civilization V - Demo
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VLC media player 1.1.3
"Warrior Epic" = Warrior Epic
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Winamp" = Winamp
"Winamp Toolbar" = Winamp Toolbar
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XP Codec Pack" = XP Codec Pack
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Xvid_is1" = Xvid 1.2.2 final uninstall
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"TeamSpeak 3 Client" = TeamSpeak 3 Client
 
========== Last 10 Event Log Errors ==========
 
[ System Events ]
Error - 05.10.2010 02:10:28 | Computer Name = R-5854B5E9F67C4 | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.
 
Error - 05.10.2010 02:10:45 | Computer Name = R-5854B5E9F67C4 | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.
 
Error - 05.10.2010 02:10:45 | Computer Name = R-5854B5E9F67C4 | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.
 
Error - 05.10.2010 02:10:45 | Computer Name = R-5854B5E9F67C4 | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.
 
Error - 05.10.2010 02:10:45 | Computer Name = R-5854B5E9F67C4 | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.
 
Error - 05.10.2010 02:10:45 | Computer Name = R-5854B5E9F67C4 | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.
 
Error - 05.10.2010 02:12:12 | Computer Name = R-5854B5E9F67C4 | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.
 
Error - 05.10.2010 02:12:12 | Computer Name = R-5854B5E9F67C4 | Source = VolSnap | ID = 393230
Description = Die Schattenkopie von Volume "C:" wurde aufgrund eines E/A-Fehlers
 abgebrochen.
 
Error - 05.10.2010 02:12:15 | Computer Name = R-5854B5E9F67C4 | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\D.
 
Error - 05.10.2010 10:20:53 | Computer Name = R-5854B5E9F67C4 | Source = Service Control Manager | ID = 7034
Description = Dienst "PC Tools Security Service" wurde unerwartet beendet. Dies 
ist bereits 1 Mal passiert.
 
 
< End of report >
         

OTL Log FIX.txt

All processes killed
========== OTL ==========
File C:\WINDOWS\System32\drivers\bctumj.sys not found.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: All Users
 
User: ********
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56504 bytes
 
User: *******
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 61960 bytes
->FireFox cache emptied: 9800022 bytes
->Flash cache emptied: 434 bytes
 
User: ********
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: ******
->Temp folder emptied: 15032444 bytes
->Temporary Internet Files folder emptied: 33695 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 57151864 bytes
->Flash cache emptied: 58431 bytes
 
User: *******
->Temp folder emptied: 1117193 bytes
->Temporary Internet Files folder emptied: 4835713 bytes
->Java cache emptied: 27740051 bytes
->FireFox cache emptied: 91227880 bytes
->Flash cache emptied: 21192 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 712604052 bytes
RecycleBin emptied: 363820 bytes
 
Total Files Cleaned = 878,00 mb
 
 
OTL by OldTimer - Version 3.2.14.1 log created on 10052010_162539

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_384.dat not found!

Registry entries deleted on Reboot...
         

Hallo und Willkommen auf Trojaner-Boar.de,

ich muss Dir leider mitteilen, dass dieses kleine Progrämmchen, dass Du Dir da eingefangen hast ein Backdoor-Trojaner ist. Das heißt, Dein System ist nichtmehr vertrauenswürdig. Du solltest Dir Gedanken machen ob es nicht besser wäre, das System neu aufzusetzen.

Dem OTL-File wird sich bald ein Spezialist zuwenden, da ich noch nicht soweit bin das zu beurteilen.

MfG. Daniel