| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: 20 tans problem auch bei mir, HELP!Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
16.12.2010, 21:01
| #1 |
| |  20 tans problem auch bei mir, HELP! heute ist leider auch bei mir das 20 Tans problem aufgetaucht, nachdem ich bei meiner bank mich einloggen wollte. Mir scheint, Ihr könnt was erkennen, wenn ich euch die OTL.txt und Extra.txt zeige: Vielen Dank für Eure HilfeOTL Logfile: Code:
ATTFilter OTL logfile created on: 16.12.2010 20:38:21 - Run 2 OTL by OldTimer - Version 3.2.17.3 Folder = C:\Dokumente und Einstellungen\xxx\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 72,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 88,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 149,04 Gb Total Space | 101,39 Gb Free Space | 68,03% Space Free | Partition Type: NTFS Drive D: | 67,75 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Drive E: | 2,54 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: MYPC1 | User Name: xxx | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Dokumente und Einstellungen\xxx\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) PRC - C:\Programme\DivX\DivX Update\DivXUpdate.exe () PRC - C:\Programme\Trojan Remover\Trjscan.exe (Simply Super Software) PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) ========== Modules (SafeList) ========== MOD - C:\Dokumente und Einstellungen\xxx\Desktop\OTL.exe (OldTimer Tools) MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation) MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6001.22319_x-ww_f0b4c2df\GdiPlus.dll (Microsoft Corporation) MOD - C:\WINDOWS\system32\shfolder.dll (Microsoft Corporation) ========== Win32 Services (SafeList) ========== SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH) SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH) SRV - (McComponentHostService) -- C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.) SRV - (IDriverT) -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe (Macrovision Corporation) SRV - (ose) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (SetupNTGLM7X) -- E:\NTGLM7X.sys File not found DRV - (NTACCESS) -- E:\NTACCESS.sys File not found DRV - (MSICPL) -- E:\install4\MSICPL.sys File not found DRV - (GMSIPCI) -- E:\INSTALL\GMSIPCI.SYS File not found DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH) DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH) DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH) DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.) DRV - (AtiHdmiService) -- C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.) DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider) DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.) DRV - (RTLE8023xp) -- C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation ) DRV - (amdide) -- C:\WINDOWS\system32\DRIVERS\amdide.sys (Advanced Micro Devices) DRV - (HdAudAddService) -- C:\WINDOWS\system32\drivers\AtiHdAud.sys (ATI Research Inc.) DRV - (AmdK8) -- C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices) DRV - (ZD1211BU(WLAN)) 802.11g USB 2.0 Wireless LAN Driver (USB)(WLAN) -- C:\WINDOWS\system32\drivers\ZD1211BU.sys (ZyDAS Technology Corporation) DRV - (rtl8139) NT-Treiber für Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2431245 IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\tbWinl.dll (Conduit Ltd.) IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 193.147.162.166:3124 ========== FireFox ========== FF - prefs.js..browser.search.defaultthis.engineName: "softonic-de3 Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.selectedEngine: "softonic-de3 Customized Web Search" FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2431245&SearchSource=13" FF - prefs.js..extensions.enabledItems: {CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B}:3.1.0625 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198 FF - prefs.js..extensions.enabledItems: finder@meingutscheincode.de:1.0.2 FF - prefs.js..extensions.enabledItems: {40c3cc16-7269-4b32-9531-17f2950fb06f}:2.5.8.6 FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.1.3 FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.2.1.3 FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.12.15 23:19:27 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.12.12 12:36:40 | 000,000,000 | ---D | M] [2009.06.21 11:29:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Extensions [2010.12.16 10:53:45 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\rfycszxx.default\extensions [2010.06.26 08:59:31 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\rfycszxx.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010.09.22 20:30:10 | 000,000,000 | ---D | M] (Winload Toolbar) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\rfycszxx.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f} [2010.11.23 22:47:16 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\rfycszxx.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} [2010.07.23 19:40:45 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\rfycszxx.default\extensions\{CE6E6E3B-84DD-4cac-9F63-8D2AE4F30A4B} [2010.11.23 22:47:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\rfycszxx.default\extensions\engine@conduit.com [2010.09.22 20:30:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\rfycszxx.default\extensions\finder@meingutscheincode.de [2010.10.19 20:28:08 | 000,000,927 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Mozilla\Firefox\Profiles\rfycszxx.default\searchplugins\conduit.xml [2010.12.16 09:37:05 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions [2010.07.18 13:21:54 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2010.06.27 19:25:48 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml [2010.06.27 19:25:48 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml [2009.08.29 10:11:27 | 000,003,700 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\fast.png [2009.08.29 10:11:27 | 000,001,963 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\fast.xml [2010.06.27 19:25:48 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml [2010.06.27 19:25:48 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml [2010.06.27 19:25:48 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2004.08.04 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O2 - BHO: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\tbWinl.dll (Conduit Ltd.) O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) O2 - BHO: (CescrtHlpr Object) - {D286E828-E6B9-484d-A058-D7323666DE33} - C:\Programme\RecFree.com\RecFreeToolbar\1.3.11.0\escort.dll (RecFree) O3 - HKLM\..\Toolbar: (RecFree Toolbar) - {0508F8F1-08E3-43EE-AAA8-09AD09803084} - C:\Programme\RecFree.com\RecFreeToolbar\1.3.11.0\escorTlbr.dll (RecFree) O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Programme\Winload\tbWinl.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [BrStsWnd] C:\Programme\Brownie\BrstsWnd.exe (brother) O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe () O4 - HKLM..\Run: [SchoWATCH] C:\Programme\SUR\SchoWATCH.exe () O4 - HKLM..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TrojanScanner] C:\Programme\Trojan Remover\Trjscan.exe (Simply Super Software) O4 - HKCU..\Run: [Mscodec] C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Dvdmod\deptor.exe () O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk = C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 80.69.100.198 80.69.100.206 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.21 08:11:19 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2008.01.08 08:08:11 | 000,000,000 | R--D | M] - E:\Autorun -- [ UDF ] O32 - AutoRun File - [2007.09.17 19:48:04 | 000,263,744 | R--- | M] (Firaxis Games) - E:\autorun.exe -- [ UDF ] O32 - AutoRun File - [2007.09.20 03:18:35 | 000,006,276 | R--- | M] () - E:\autorun.inf -- [ UDF ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2010.12.16 17:16:44 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\xxx\Desktop\OTL.exe [2010.12.16 17:09:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Malwarebytes [2010.12.16 17:09:39 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010.12.16 17:09:38 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes [2010.12.16 17:09:35 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010.12.16 17:09:35 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware [2010.12.16 16:37:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Eigene Dateien\Simply Super Software [2010.12.16 16:37:18 | 000,069,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ztvcabinet.dll [2010.12.16 16:37:16 | 000,000,000 | ---D | C] -- C:\Programme\Trojan Remover [2010.12.16 16:37:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Simply Super Software [2010.12.16 16:37:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Simply Super Software [2010.12.16 16:26:42 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\nCleaner [2010.12.16 16:26:31 | 000,000,000 | ---D | C] -- C:\Programme\NKProds [2010.12.16 16:25:49 | 000,892,614 | ---- | C] (NKProds) -- C:\Dokumente und Einstellungen\xxx\Desktop\ncleaner_setup.exe [2010.12.15 13:03:17 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndproxy.sys [2010.12.15 13:02:54 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wab.exe [2010.12.09 23:24:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Adobe [2010.12.09 22:56:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData [2010.12.01 23:57:26 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Avira [2010.12.01 23:53:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Dvdmod [2010.11.27 21:26:08 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP [2010.11.27 21:24:23 | 000,000,000 | ---D | C] -- C:\Programme\Common Files [2010.11.27 21:23:56 | 000,000,000 | ---D | C] -- C:\Programme\IMSIDesign [2010.11.27 21:23:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\IMSIDesign [2010.11.27 21:22:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Eigene Dateien\TurboCAD 16 de [2010.11.27 21:22:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\IMSIDesign [2010.11.27 21:22:01 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\IMSI [2010.11.27 21:21:31 | 000,000,000 | ---D | C] -- C:\Programme\TurboCAD Professional 16 Setup [2010.11.27 12:33:22 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Desktop\cad [2010.11.25 22:07:37 | 000,000,000 | ---D | C] -- C:\Programme\A9Tech [2010.11.24 20:33:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\IGC [2010.11.24 20:32:40 | 000,000,000 | ---D | C] -- C:\Programme\IGC [2010.11.24 20:16:57 | 000,425,984 | ---- | C] (SYCODE) -- C:\WINDOWS\SYCLicenseU_100811.dll [2010.11.24 20:16:55 | 010,850,304 | ---- | C] (SYCODE) -- C:\WINDOWS\DDLibU.dll [2010.11.24 20:16:55 | 000,663,552 | ---- | C] (SYCODE) -- C:\WINDOWS\SYCGUIU.dll [2010.11.24 20:16:53 | 000,000,000 | ---D | C] -- C:\Programme\SYCODE [2010.11.24 19:56:10 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\IGC [2010.11.24 19:55:55 | 001,060,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MFC71.dll [2010.11.24 19:55:55 | 000,245,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\unicows.dll [2010.11.23 22:47:23 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\softonic-de3 [2010.11.23 22:47:20 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\ConduitEngine [2010.11.23 22:47:19 | 000,000,000 | ---D | C] -- C:\Programme\ConduitEngine [2010.11.23 22:47:17 | 000,000,000 | ---D | C] -- C:\Programme\softonic-de3 [2010.11.23 22:47:07 | 000,000,000 | ---D | C] -- C:\Programme\Apperson [2010.11.23 22:34:57 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Desktop\Neuer Ordner (4) [2010.11.23 22:29:30 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google [2010.11.18 19:12:41 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\isign32.dll [9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2049.12.31 15:00:00 | 000,022,776 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\pic05705.jpg [2010.12.16 20:37:39 | 000,000,247 | ---- | M] () -- C:\WINDOWS\Brownie.ini [2010.12.16 20:37:22 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010.12.16 20:37:22 | 000,001,082 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2010.12.16 20:37:14 | 000,056,728 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap [2010.12.16 20:37:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010.12.16 18:42:00 | 000,001,086 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2010.12.16 17:16:28 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\xxx\Desktop\OTL.exe [2010.12.16 16:44:42 | 000,458,822 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2010.12.16 16:44:42 | 000,441,124 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010.12.16 16:44:42 | 000,084,326 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2010.12.16 16:44:42 | 000,071,060 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010.12.16 16:33:40 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\w32apiw.dll [2010.12.16 16:25:51 | 000,892,614 | ---- | M] (NKProds) -- C:\Dokumente und Einstellungen\xxx\Desktop\ncleaner_setup.exe [2010.12.16 12:14:19 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010.12.15 20:12:52 | 000,146,016 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010.12.14 20:43:19 | 000,001,777 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk [2010.12.09 22:54:31 | 000,135,096 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avipbb.sys [2010.12.04 10:49:40 | 000,000,432 | ---- | M] () -- C:\WINDOWS\BRWMARK.INI [2010.12.02 20:41:25 | 000,061,960 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\drivers\avgntflt.sys [2010.11.29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2010.11.29 17:42:06 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2010.11.28 21:13:02 | 000,000,167 | ---- | M] () -- C:\WINDOWS\LuminancesDlg.ini [2010.11.28 21:13:02 | 000,000,167 | ---- | M] () -- C:\WINDOWS\EnvironmentsDlg.ini [2010.11.28 14:24:06 | 002,707,268 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\P1020446.JPG [2010.11.28 14:23:12 | 002,712,119 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\P1020444.JPG [2010.11.27 21:25:20 | 000,001,960 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\TurboCAD Professional V.16.lnk [2010.11.25 22:07:39 | 000,001,972 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\A9CAD.lnk [2010.11.24 23:27:29 | 000,203,286 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Eigene Dateien\3086_Einfamilienhaus_xxx_A.dwg.pdf [2010.11.24 20:32:40 | 000,001,435 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Free DWG Viewer.lnk [2010.11.24 20:16:57 | 000,000,762 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\DWG Import for SolidWorks.lnk [2010.11.23 22:46:56 | 000,725,248 | ---- | M] () -- C:\Dokumente und Einstellungen\xxx\Desktop\cslte370.exe [2010.11.18 19:12:41 | 000,086,016 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\isign32.dll [2010.11.18 19:12:41 | 000,086,016 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\isign32.dll [9 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2010.12.16 16:37:18 | 000,162,304 | ---- | C] () -- C:\WINDOWS\System32\ztvunrar36.dll [2010.12.16 16:37:18 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\UNRAR3.dll [2010.12.16 16:37:18 | 000,077,312 | ---- | C] () -- C:\WINDOWS\System32\ztvunace26.dll [2010.12.16 16:37:18 | 000,075,264 | ---- | C] () -- C:\WINDOWS\System32\unacev2.dll [2010.12.16 16:26:44 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\w32apiw.dll [2010.11.28 21:13:02 | 000,000,167 | ---- | C] () -- C:\WINDOWS\LuminancesDlg.ini [2010.11.28 21:13:02 | 000,000,167 | ---- | C] () -- C:\WINDOWS\EnvironmentsDlg.ini [2010.11.28 14:29:26 | 002,712,119 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\P1020444.JPG [2010.11.28 14:28:51 | 002,707,268 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\P1020446.JPG [2010.11.27 21:25:20 | 000,001,960 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\TurboCAD Professional V.16.lnk [2010.11.25 22:07:39 | 000,001,972 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\A9CAD.lnk [2010.11.24 23:27:28 | 000,203,286 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Eigene Dateien\3086_Einfamilienhaus_xxx_A.dwg.pdf [2010.11.24 20:32:40 | 000,001,435 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Free DWG Viewer.lnk [2010.11.24 20:16:57 | 000,000,762 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\DWG Import for SolidWorks.lnk [2010.11.23 22:46:55 | 000,725,248 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\cslte370.exe [2010.11.23 18:27:35 | 000,471,040 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Desktop\dp TW.xls [2010.11.15 20:26:01 | 000,000,000 | ---- | C] () -- C:\WINDOWS\BEMERK~1.INI [2010.11.15 20:25:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WdbInstW.INI [2010.09.22 20:30:46 | 000,000,514 | ---- | C] () -- C:\WINDOWS\GaebWriter.INI [2010.09.22 20:12:11 | 000,011,275 | ---- | C] () -- C:\WINDOWS\System32\kgittsd.dll [2010.09.22 20:11:59 | 000,011,275 | ---- | C] () -- C:\WINDOWS\System32\gttsd.dll [2010.07.28 22:53:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ValloFlex PLAN.INI [2010.05.31 16:44:17 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll [2010.05.20 11:47:08 | 000,025,713 | ---- | C] () -- C:\WINDOWS\CSTBox.INI [2010.01.23 15:06:49 | 000,000,138 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2009.10.19 10:04:50 | 000,052,224 | ---- | C] () -- C:\Dokumente und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.07.10 22:18:51 | 000,000,141 | ---- | C] () -- C:\WINDOWS\BRVIDEO.INI [2009.07.10 22:18:51 | 000,000,000 | ---- | C] () -- C:\WINDOWS\brmx2001.ini [2009.07.10 22:18:50 | 000,000,432 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI [2009.07.10 22:18:44 | 000,000,114 | ---- | C] () -- C:\WINDOWS\System32\brlmw03a.ini [2009.07.10 22:18:43 | 000,009,853 | ---- | C] () -- C:\WINDOWS\HL-2140.INI [2009.07.10 22:17:57 | 000,000,247 | ---- | C] () -- C:\WINDOWS\Brownie.ini [2009.06.28 09:35:44 | 000,815,104 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009.06.28 09:35:44 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009.06.21 09:00:51 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2009.06.21 08:14:29 | 000,001,082 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2008.01.15 03:31:00 | 000,000,530 | ---- | C] () -- C:\WINDOWS\System32\tx14_ic.ini ========== Alternate Data Streams ========== @Alternate Data Stream - 131 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:99671BE2 @Alternate Data Stream - 115 bytes -> C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP:FD34FE88 < End of report > OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 16.12.2010 20:38:21 - Run 2
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Dokumente und Einstellungen\xxx\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 72,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 88,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 149,04 Gb Total Space | 101,39 Gb Free Space | 68,03% Space Free | Partition Type: NTFS
Drive D: | 67,75 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 2,54 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Computer Name: MYPC1 | User Name: xxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- C:\Programme\Google\Chrome\Application\chrome.exe (Google Inc.)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
http [open] -- "C:\Programme\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Programme\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\eMule\emule.exe" = C:\Programme\eMule\emule.exe:*:Enabled:eMule -- (hxxp://www.emule-project.net)
"C:\Programme\Java\jre6\bin\javaw.exe" = C:\Programme\Java\jre6\bin\javaw.exe:*:Disabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Java\jre6\bin\java.exe" = C:\Programme\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Programme\Google\Google Earth\client\googleearth.exe" = C:\Programme\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google)
"C:\Programme\Google\Google Earth\plugin\geplugin.exe" = C:\Programme\Google\Google Earth\plugin\geplugin.exe:*:Enabled:Google Earth -- (Google)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{04830D0F-F980-4EC0-89F1-594F2FD2A1B5}" = ElsterFormular 2008/2009
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{05C6319B-E47E-85F0-BAD0-46B4E4603921}" = Catalyst Control Center Localization Chinese Traditional
"{09086BA1-DDAD-0F5F-639C-55EEA9DCAAA0}" = CCC Help Norwegian
"{0D71EC64-26F3-4622-B01C-8311DB5303A8}" = A9Converter
"{0F85512A-3D47-A3C5-1320-B73781E91F2D}" = CCC Help English
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 19
"{2AD04353-679A-1B31-65DF-15C3F21D1E2C}" = Catalyst Control Center Graphics Full New
"{30D1F3D2-54CF-481D-A005-F94B0E98FEEC}" = Sid Meier's Civilization 4 Complete
"{3248F0A8-6813-11D6-A77B-00B0D0150000}" = J2SE Runtime Environment 5.0
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{36CDA33B-909B-4719-97D1-C4B99309BDC7}" = ATI Parental Control & Encoder
"{38DE04AE-157F-5B4A-F9E3-956C57327236}" = Catalyst Control Center Localization Dutch
"{3987B905-1445-DC2B-BD61-08C4A2A0F684}" = CCC Help Chinese Standard
"{3C1D122F-BAD1-D2D7-31F5-D18A5CD8EF65}" = Catalyst Control Center Localization Danish
"{3E3B0A7D-5D42-0270-E952-7F003C951382}" = CCC Help French
"{4039A82B-E6D2-9332-CFA5-D6027BB0681F}" = CCC Help German
"{40FAB9CD-D1A8-44DC-9B61-38B135E26E67}_is1" = Ask Default Search
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4F2C5657-A9E6-6FCB-DAAC-0B8D599D7D73}" = Catalyst Control Center Localization Norwegian
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{70501AFA-3111-F68C-31F5-12D53E8A242D}" = CCC Help Japanese
"{719CC281-0146-40E5-E6D6-19C4CE0EB7B8}" = CCC Help Italian
"{7768C917-F746-3C0E-8E71-C6FC0A3A1433}" = Catalyst Control Center Localization Japanese
"{79E5DFEF-66DC-EB3C-44FF-E2FB0CB73B1F}" = Catalyst Control Center Localization French
"{82980AFC-1590-4A67-9A94-65B00BDCA006}" = ValloFlex PLAN
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU
"{898F90F7-D19A-6C11-086B-157B07D2048E}" = Catalyst Control Center Localization Chinese Standard
"{8A4F67AC-C6D5-49C4-919B-E8C2C1B4B0B2}" = DibaNet 8.04
"{8C7CADC4-11CB-B92B-0511-26FEBF3BB5DB}" = ccc-utility
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90850407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{9353F6E9-13B7-43B4-8FA5-CB46CA22671B}" = Haufe Formular-Mxxxger
"{936C9054-0FAF-C632-A310-2C066CD25C21}" = Catalyst Control Center Graphics Full Existing
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{99E862CC-6F69-4D39-99AA-DBF71BF3B585}" = OpenOffice.org 3.1
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9A6150D4-97ED-072A-03AD-5946CC7E3DEC}" = Catalyst Control Center Localization Italian
"{9BE22123-D4EE-4D3A-BE87-B5B2622537EF}" = Catalyst Control Center - Branding
"{9C359424-A629-4AB9-8053-F9D065F6EC81}" = Brother HL-2140
"{9D2A99D7-1858-9A97-4E61-B479AECAC611}" = Catalyst Control Center Localization Finnish
"{A0BE01E5-A6DB-4BAD-04F9-E0DFCE973BDA}" = ccc-core-static
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A89131FD-3D18-4DA8-84C8-622423011B51}_is1" = ALNO AG Küchenplaner
"{A8EDD99D-82B0-F46C-7278-0210380E7782}" = CCC Help Finnish
"{A90DA38A-D1DA-D491-4786-F468F215DD6B}" = CCC Help Chinese Traditional
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-A91000000001}" = Adobe Reader 9.1.2 - Deutsch
"{AEFB743B-D2B6-BE48-1D10-669BF13F8597}" = Skins
"{B59B747F-1396-6A42-E0BC-617BA5749038}" = CCC Help Dutch
"{B6C2569C-E2AA-4AB9-8C26-AC2487A2BFFC}" = Sid Meier's Civilization 4
"{B84896E4-EEDB-40EE-9CEC-6573B880DBD7}" = TurboCAD Professional V.16
"{B8B4D43C-EAA0-4EEC-B93E-D4D012316286}" = Free DWG Viewer 7.0
"{B96DB037-DBEA-4186-9081-9CBD537F82E8}" = 3D-Viewer-innoPlus
"{BCE46757-7674-4416-BEDB-68205A60409E}" = Canon CanoScan Toolbox 4.1
"{BED1BED2-77DB-1ADA-CD0D-6C2DC1B151EE}" = Catalyst Control Center Localization Spanish
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver
"{C8E104FE-D57E-4082-9524-6C3A1C8DBDD7}" = A9CAD
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CFBCE791-2D53-4FCE-B3FB-D6E01F4112E8}" = Sid Meier's Civilization 4
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D112F7F7-974C-7C4A-49C4-09765428A08B}" = CCC Help Danish
"{D26E204B-96CE-0A5A-ABA0-505E97C0E6F7}" = CCC Help Spanish
"{D6ECC096-57F6-5498-14DB-EECB48074D04}" = ccc-core-preinstall
"{E0FC6870-705C-76A5-109E-9069BDC664EA}" = CCC Help Swedish
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{EE810E02-37D3-D616-9448-558DA1D72139}" = Catalyst Control Center Core Implementation
"{F000DE4C-B6CB-4181-BAFF-EC5DA2A9C156}" = RuntimeLibsVC90
"{F0C721C3-B562-76F4-3570-B9A5773B649A}" = Catalyst Control Center Localization German
"{F0D24E5C-57E9-9F66-30E2-452BCE45883A}" = Catalyst Control Center Graphics Light
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FB328A29-1F61-0F38-D672-7B5265735AB8}" = Catalyst Control Center Localization Swedish
"ABC Amber Text Converter" = ABC Amber Text Converter
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"Any Video Converter Professional_is1" = Any Video Converter Professional 3.0.4
"ATI Display Driver" = ATI Display Driver
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"conduitEngine" = Conduit Engine
"DivX Setup.divx.com" = DivX-Setup
"DWG Import for SolidWorks_is1" = DWG Import for SolidWorks
"ElsterFormular 11.1.2.3848" = ElsterFormular
"eMule" = eMule
"Google Chrome" = Google Chrome
"HPR_Bauherr" = Bauherren-Handbuch
"ie8" = Windows Internet Explorer 8
"JDownloader" = JDownloader
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"nCleaner" = nCleaner second 2.3.4.0
"PlayChess" = PlayChess
"RecFreeToolbar" = RecFree toolbar powered by Ask.com
"softonic-de3 Toolbar" = softonic-de3 Toolbar
"SUR" = SUR
"Trojan Remover_is1" = Trojan Remover 6.8.2
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"Winload Toolbar" = Winload Toolbar
"WinRAR archiver" = WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xvid_is1" = Xvid 1.2.1 final uninstall
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 11.11.2010 08:32:59 | Computer Name = MYPC1 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 1.9.2.3951, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 13.11.2010 09:01:09 | Computer Name = MYPC1 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 1.9.2.3951, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 23.11.2010 13:42:19 | Computer Name = MYPC1 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung soffice.bin, Version 3.1.9398.500, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 01.12.2010 15:38:06 | Computer Name = MYPC1 | Source = ESENT | ID = 490
Description = svchost (1296) Versuch, Datei "C:\WINDOWS\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb"
für den Lese-/Schreibzugriff zu öffnen, ist mit Systemfehler 32 (0x00000020): "Der
Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet
wird. " fehlgeschlagen. Fehler -1032 (0xfffffbf8) beim Öffnen von Dateien.
Error - 03.12.2010 08:26:36 | Computer Name = MYPC1 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 1.9.2.3951, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 06.12.2010 13:36:41 | Computer Name = MYPC1 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 1.9.2.3951, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 08.12.2010 13:54:38 | Computer Name = MYPC1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung divx plus player.exe, Version 10.2.1.20,
fehlgeschlagenes Modul unknown, Version 0.0.0.0, Fehleradresse 0xa00008af.
Error - 08.12.2010 18:35:51 | Computer Name = MYPC1 | Source = Avira AntiVir | ID = 4118
Description = AUSNAHMEFEHLER beim Aufruf der Funktion <Scan> für die Datei C:\Dokumente
und Einstellungen\xxx\Lokale Einstellungen\Anwendungsdaten\Mozilla\Firefox\Profiles\4kzfbue2.default\Cache\F3E6069Dd01.
[ACCESS_VIOLATION Exception!! EIP = 0x1b12288] Bitte Avira informieren und die
obige Datei übersenden!
Error - 14.12.2010 04:27:05 | Computer Name = MYPC1 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung firefox.exe, Version 1.9.2.3989, Stillstandmodul
hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
Error - 16.12.2010 11:34:20 | Computer Name = MYPC1 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung ncleaner.exe, Version 2.3.4.0, fehlgeschlagenes
Modul ncleaner.exe, Version 2.3.4.0, Fehleradresse 0x000761c4.
< End of report >
Geändert von riedberger (16.12.2010 um 21:08 Uhr) |
|
16.12.2010, 21:17
| #2 |
| /// Malware-holic   | 20 tans problem auch bei mir, HELP! • Starte bitte die OTL.exe
__________________• Kopiere nun das Folgende in die Textbox. :OTL O4 - HKCU..\Run: [Mscodec] C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Dvdmod\deptor.exe () [2010.12.01 23:53:24 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Dvdmod :Files :Commands [purity] [EMPTYFLASH] [resethosts] [emptytemp] [Reboot] • Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort posten. öffne den arbeitsplatz, c: dann _OTL dort rechtsklick auf moved files wähle zu moved files.rar oder zip hinzufügen. lade das archiv in unserem upload channel hoch. http://www.trojaner-board.de/54791-a...ner-board.html
__________________ |
|
17.12.2010, 00:42
| #3 |
| | 20 tans problem auch bei mir, HELP! Hallo - Hier die ole-text Datei
__________________All processes killed ========== OTL ========== Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Mscodec deleted successfully. C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Dvdmod\deptor.exe moved successfully. C:\Dokumente und Einstellungen\xxx\Anwendungsdaten\Dvdmod folder moved successfully. ========== FILES ========== ========== COMMANDS ========== [EMPTYFLASH] User: All Users User: xxx ->Flash cache emptied: 101537 bytes User: Default User User: xxx ->Flash cache emptied: 1047 bytes User: LocalService User: NetworkService User: xxx ->Flash cache emptied: 1465 bytes Total Flash Files Cleaned = 0,00 mb C:\WINDOWS\System32\drivers\etc\Hosts moved successfully. HOSTS file reset successfully [EMPTYTEMP] User: All Users User: xxx ->Temp folder emptied: 72139326 bytes ->Temporary Internet Files folder emptied: 231391184 bytes ->Java cache emptied: 62677874 bytes ->FireFox cache emptied: 110342078 bytes ->Google Chrome cache emptied: 6854300 bytes ->Flash cache emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: xxx ->Temp folder emptied: 109816423 bytes ->Temporary Internet Files folder emptied: 9597557 bytes ->Java cache emptied: 81444457 bytes ->FireFox cache emptied: 107405760 bytes ->Google Chrome cache emptied: 370214334 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33237 bytes User: xxx ->Temp folder emptied: 766397 bytes ->Temporary Internet Files folder emptied: 190192 bytes ->Java cache emptied: 25802386 bytes ->FireFox cache emptied: 95922008 bytes ->Flash cache emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2195157 bytes %systemroot%\System32 .tmp files removed: 3771271 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 2429 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 1.231,00 mb OTL by OldTimer - Version 3.2.17.3 log created on 12172010_002453 Files\Folders moved on Reboot... Registry entries deleted on Reboot... |
|
17.12.2010, 12:01
| #4 |
| /// Malware-holic | 20 tans problem auch bei mir, HELP! ok, du solltest jetzt ne datensicherung machen, dann sollten wir den pc neu aufsetzen/vernünftig absichern.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu 20 tans problem auch bei mir, HELP! |
| 0x00000001, 20 tans, alternate, antivir, any video converter, avgntflt.sys, avira, bho, canon, error, firefox, firefox.exe, flash player, format, google earth, help, helper, jdownloader, jusched.exe, location, logfile, microsoft office word, mozilla, object, oldtimer, otl.exe, otl.txt, plug-in, problem, prozess, realtek, registry, rundll, saver, scan, sched.exe, searchplugins, security, security scan, server, shell32.dll, software, super, svchost, system restore, trojan, usb, usb 2.0, video converter, windows internet, winload toolbar, wlan |
Linear-Darstellung
