Hallo,

ich bekomme seit gestern eine Aufforderung, dass ich 10 TAN Nummern eingeben soll.

Habe einen ähnlichen Post gefunden und hab schon scan mit OTL ausgeführt. Die Lösung für den anderen Nutzer scheint für mich nicht die richtige zu sein, da
(http://www.trojaner-board.de/93361-2...sparkasse.html)

Er sollte dies eingeben:
:OTL
O4 - HKU\S-1-5-21-3621993508-448967032-2305503300-1000..\Run: [Beat] C:\Users\Pascal\AppData\Roaming\Adobe\Update\blticm.exe ()
O4 - HKU\S-1-5-21-3621993508-448967032-2305503300-1000..\Run: [Helper] C:\Users\Pascal\AppData\Roaming\Helper\bin\liveu.exe ()
O4 - HKU\S-1-5-21-3621993508-448967032-2305503300-1000..\Run: [iscsmsdt] C:\Users\Pascal\AppData\Local\Temp\chkdepad.DLL ()
[2010.10.18 16:45:32 | 000,000,000 | ---D | M] -- C:\Users\Pascal\AppData\Roaming\Helper


Die Exe-Dateien (blticm.exe, liveu.exe ,chkdepad.DLL) finde ich bei mir allerdings nicht.

Was bewirken diese Zeilen ? ... und kann mir jemand sagen was ich eingeben muss ? .. Wäre super.

Was mir noch nicht ganz klar ist, warum danach das System doch neu aufgesetzt werden musste ?

Hijackthis konnte mir nicht helfen.

Vielen Dank,
Chris

wo sind die otl logs?
wir senden die dateien zur weiteren analyse, damit andere und du in zukunft geschützt sind.

ähm klar, sorry ....

otl.txtOTL Logfile:

OTL logfile created on: 27.12.2010 16:31:03 - Run 1
OTL by OldTimer - Version 3.2.18.0     Folder = C:\Documents and Settings\Chris\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
 
1.022,00 Mb Total Physical Memory | 335,00 Mb Available Physical Memory | 33,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 68,00% Paging File free
Paging file location(s): C:\pagefile.sys 1488 2976 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 44,20 Gb Free Space | 59,32% Space Free | Partition Type: NTFS
Drive D: | 425,99 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive G: | 1,86 Gb Total Space | 1,83 Gb Free Space | 98,23% Space Free | Partition Type: FAT
 
Computer Name: CHRIS-FUJI | User Name: Chris | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Documents and Settings\Chris\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Eraser\Eraser.exe (The Eraser Project)
PRC - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
PRC - C:\Program Files\TortoiseSVN\bin\TSVNCache.exe (TortoiseSVN)
PRC - C:\Program Files\Ant.com\IE add-on\AntUpdaterService.exe (Ant.com)
PRC - C:\Program Files\Windows Live\Contacts\wlcomm.exe (Microsoft Corporation)
PRC - C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
PRC - c:\Program Files\Avira\AntiVir Desktop\avcenter.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avscan.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\WINDOWS\system32\sistray.exe (Silicon Integrated Systems Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Aquip\AWLAN-N2\UI.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
PRC - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\Acrobat.exe (Adobe Systems Incorporated)
PRC - C:\Program Files\Adobe\Acrobat 7.0\Distillr\acrotray.exe (Adobe Systems Inc.)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Documents and Settings\Chris\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\system32\ntbaycfg.dll ()
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (Apple Mobile Device) -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (TestHandler) -- C:\Program Files\Fujitsu\SystemDiagnostics\OnlineDiagnostic\TestManager\HaDTMan.exe (Fujitsu Technology Solutions)
SRV - (AntUpdaterService) -- C:\Program Files\Ant.com\IE add-on\AntUpdaterService.exe (Ant.com)
SRV - (NMSAccess) -- C:\Program Files\CDBurnerXP\NMSAccessU.exe ()
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (SetupNTGLM7X) -- D:\NTGLM7X.sys File not found
DRV - (NTACCESS) -- D:\NTACCESS.sys File not found
DRV - (MSICPL) -- D:\install4\MSICPL.sys File not found
DRV - (GMSIPCI) -- D:\INSTALL\GMSIPCI.SYS File not found
DRV - (cpuz132) -- C:\DOCUME~1\Chris\LOCALS~1\Temp\cpuz132\cpuz132_x32.sys File not found
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (StarOpen) -- C:\WINDOWS\System32\drivers\StarOpen.sys ()
DRV - (SiSkp) -- C:\WINDOWS\system32\drivers\srvkp.sys (Silicon Integrated Systems Corporation)
DRV - (SiS315) -- C:\WINDOWS\system32\drivers\sisgrp.sys (Silicon Integrated Systems Corporation)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (HDAudBus) -- C:\WINDOWS\system32\drivers\hdaudbus.sys (Windows (R) Server 2003 DDK provider)
DRV - (rt2870) -- C:\WINDOWS\system32\drivers\rt2870.sys (Ralink Technology, Corp.)
DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation                           )
DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
DRV - (rtl8139) Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1409082233-1303643608-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1409082233-1303643608-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {a7c6cf7f-112c-4500-a7ea-39801a327e5f}:1.0.9
FF - prefs.js..extensions.enabledItems: anttoolbar@ant.com:2.2.1
 
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010.12.22 18:46:03 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.10\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.12.22 18:46:02 | 000,000,000 | ---D | M]
 
[2010.10.03 17:41:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Mozilla\Extensions
[2010.12.21 15:44:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\wur7pojb.default\extensions
[2010.10.03 17:42:44 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\wur7pojb.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.10.03 17:42:45 | 000,000,000 | ---D | M] (FireFTP) -- C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\wur7pojb.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
[2010.12.15 17:01:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\wur7pojb.default\extensions\anttoolbar@ant.com
[2010.10.03 17:31:13 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010.09.14 22:32:39 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.09.14 22:32:39 | 000,002,344 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.09.14 22:32:39 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.09.14 22:32:39 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.09.14 22:32:39 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2010.12.13 20:21:38 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Ant.com Toolbars browser helper (video detector)) - {346FDE31-DFF9-418A-90C8-BA31DC9FF2EF} - C:\Program Files\Ant.com\IE add-on\Download.antplugin (Ant.com)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (AcroIEToolbarHelper Class) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Ant.com Download Toolbar) - {2E924F4F-67F0-4BD8-9560-49F468E843D2} - C:\Program Files\Ant.com\IE add-on\AntToolbar.dll (Ant.com)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKU\S-1-5-21-1409082233-1303643608-682003330-1003\..\Toolbar\WebBrowser: (Ant.com Download Toolbar) - {2E924F4F-67F0-4BD8-9560-49F468E843D2} - C:\Program Files\Ant.com\IE add-on\AntToolbar.dll (Ant.com)
O3 - HKU\S-1-5-21-1409082233-1303643608-682003330-1003\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [Acrobat Assistant 7.0] C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe (The Eraser Project)
O4 - HKLM..\Run: [SiSPower] C:\WINDOWS\System32\SiSPower.dll (Silicon Integrated Systems Corporation)
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKU\S-1-5-21-1409082233-1303643608-682003330-1003..\Run: [WdEventClock]  File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat - Schnellstart.lnk = C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000002}\SC_Acrobat.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Aquip AWLAN-N2.lnk = C:\Program Files\Aquip\AWLAN-N2\UI.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe (Silicon Integrated Systems Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1409082233-1303643608-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: Download videos by Ant.com - {70AF6C9F-0818-4cf7-924A-BBDBB24211D3} - C:\Program Files\Ant.com\IE add-on\Download.antplugin (Ant.com)
O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe ()
O9 - Extra 'Tools' menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.01.19 20:58:50 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{4974ae58-6eec-11df-86f2-00b08c013b22}\Shell\AutoRun\command - "" = I:\Menu.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: javanw16 - (C:\WINDOWS\system32\ntbaycfg.dll) - C:\WINDOWS\system32\ntbaycfg.dll ()
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: 6to4 -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Iprip -  File not found
NetSvcs: Irmon -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: WmdmPmSp -  File not found
 
 
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: sermouse.sys - Driver
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vds - Service
SafeBootMin: vga.sys - Driver
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: sermouse.sys - Driver
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vga.sys - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {A29E223B-BD1A-7FB6-8FEB-D6B1CD9D9FFB} - Browser Customizations
ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
ActiveX: {C314CE45-3392-3B73-B4E1-139CD41CA933} - .NET Framework
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
 
Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax ()
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll ()
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point (88959703391928320)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010.12.27 16:27:03 | 000,602,624 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Chris\Desktop\OTL.exe
[2010.12.25 18:14:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chris\Local Settings\Application Data\LibcrtServices
[2010.12.25 17:58:08 | 000,000,000 | ---D | C] -- C:\Program Files\eMule
[2010.12.24 08:47:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chris\Desktop\SimSoftware
[2010.12.23 23:04:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chris\Application Data\Mozilla-Cache
[2010.12.23 22:59:38 | 000,000,000 | ---D | C] -- C:\Program Files\PartyGaming
[2010.12.23 17:38:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chris\Application Data\Canneverbe Limited
[2010.12.23 17:38:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2010.12.23 17:38:20 | 000,000,000 | ---D | C] -- C:\Program Files\CDBurnerXP
[2010.12.23 10:29:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chris\Local Settings\Application Data\Eraser 6
[2010.12.22 23:43:38 | 000,203,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\RICHTX32.OCX
[2010.12.22 23:43:37 | 000,407,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSHFLXGD.OCX
[2010.12.22 23:43:32 | 000,647,872 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mscomct2.ocx
[2010.12.22 18:59:15 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2010.12.22 18:58:51 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010.12.22 18:44:19 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010.12.22 18:27:06 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2010.12.22 18:26:50 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010.12.21 16:34:19 | 000,000,000 | ---D | C] -- C:\Program Files\Hobbyist Software
[2010.12.20 23:45:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chris\My Documents\Meine empfangenen Dateien
[2010.12.20 10:53:51 | 000,000,000 | ---D | C] -- C:\Program Files\Eraser
[2010.12.17 21:26:08 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Chris\Recent
[2010.12.16 22:54:13 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndproxy.sys
[2010.12.16 22:51:35 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wab.exe
[2010.12.13 20:21:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chris\Desktop\backups
[2010.12.13 20:21:09 | 000,388,608 | ---- | C] (Trend Micro Inc.) -- C:\Documents and Settings\Chris\Desktop\HijackThis.exe
[2010.12.13 20:18:43 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Fujitsu
[2010.12.13 20:18:35 | 000,000,000 | ---D | C] -- C:\Program Files\Fujitsu
[2010.12.12 13:32:50 | 000,274,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll
[2010.12.12 13:32:50 | 000,016,736 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll.mui
[2010.12.11 17:03:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Chris\Tracing
[2010.12.11 16:44:38 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft
[2010.12.11 16:44:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Documents\microsoft
[2010.12.11 16:43:27 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Live
[2010.12.11 16:37:37 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Windows Live
[2010.11.29 17:38:30 | 000,094,208 | ---- | C] (Apple Inc.) -- C:\WINDOWS\System32\QuickTimeVR.qtx
[2010.11.29 17:38:30 | 000,069,632 | ---- | C] (Apple Inc.) -- C:\WINDOWS\System32\QuickTime.qts
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2010.12.27 16:29:07 | 000,602,624 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Chris\Desktop\OTL.exe
[2010.12.27 16:08:50 | 000,002,335 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat - Schnellstart.lnk
[2010.12.27 16:07:45 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010.12.27 16:07:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010.12.27 00:15:55 | 000,048,543 | ---- | M] () -- C:\Documents and Settings\Chris\Desktop\rose_gruen[1].jpg
[2010.12.26 13:25:46 | 000,000,804 | ---- | M] () -- C:\Documents and Settings\Chris\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010.12.26 13:22:35 | 000,048,128 | -H-- | M] () -- C:\WINDOWS\System32\ntbaycfg.dll
[2010.12.26 12:36:43 | 000,028,672 | ---- | M] () -- C:\Documents and Settings\Chris\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.12.23 23:01:54 | 000,001,668 | ---- | M] () -- C:\Documents and Settings\Chris\Application Data\Microsoft\Internet Explorer\Quick Launch\PartyPoker.lnk
[2010.12.23 23:01:54 | 000,001,650 | ---- | M] () -- C:\Documents and Settings\Chris\Desktop\PartyPoker.lnk
[2010.12.23 17:38:30 | 000,001,604 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CDBurnerXP.lnk
[2010.12.22 23:45:09 | 000,000,847 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\MATLAB R2009b.lnk
[2010.12.22 19:08:37 | 000,001,542 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010.12.22 18:45:23 | 000,001,604 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010.12.22 17:50:04 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010.12.21 15:42:35 | 000,175,546 | ---- | M] () -- C:\Documents and Settings\Chris\Desktop\GünzburgMehrfamilienhaus.pdf
[2010.12.20 11:38:59 | 004,713,472 | ---- | M] () -- C:\Documents and Settings\Chris\Desktop\New Microsoft Word-Dokument.doc
[2010.12.20 11:02:44 | 000,270,903 | ---- | M] () -- C:\Documents and Settings\Chris\Desktop\römerstein.pdf
[2010.12.20 10:53:54 | 000,001,536 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Eraser.lnk
[2010.12.20 10:36:40 | 000,501,995 | ---- | M] () -- C:\Documents and Settings\Chris\Desktop\loipenplan07laichingen.pdf
[2010.12.20 10:36:04 | 000,839,939 | ---- | M] () -- C:\Documents and Settings\Chris\Desktop\loipenbeschr07-laichingen.pdf
[2010.12.20 10:33:41 | 002,156,297 | ---- | M] () -- C:\Documents and Settings\Chris\Desktop\Loipenplan-Blaubeuren.pdf
[2010.12.17 18:48:30 | 000,117,360 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010.12.17 00:46:26 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2010.12.13 20:21:38 | 000,000,734 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2010.12.13 20:21:16 | 000,388,608 | ---- | M] (Trend Micro Inc.) -- C:\Documents and Settings\Chris\Desktop\HijackThis.exe
[2010.12.13 20:19:06 | 000,001,802 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SystemDiagnostics.lnk
[2010.12.05 18:53:09 | 144,596,243 | ---- | M] () -- C:\Documents and Settings\Chris\Desktop\nitesswmv.wmv
[2010.11.29 17:38:30 | 000,094,208 | ---- | M] (Apple Inc.) -- C:\WINDOWS\System32\QuickTimeVR.qtx
[2010.11.29 17:38:30 | 000,069,632 | ---- | M] (Apple Inc.) -- C:\WINDOWS\System32\QuickTime.qts
[6 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2010.12.27 00:16:04 | 000,048,543 | ---- | C] () -- C:\Documents and Settings\Chris\Desktop\rose_gruen[1].jpg
[2010.12.26 13:25:46 | 000,000,804 | ---- | C] () -- C:\Documents and Settings\Chris\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
[2010.12.26 13:22:35 | 000,048,128 | -H-- | C] () -- C:\WINDOWS\System32\ntbaycfg.dll
[2010.12.23 23:01:54 | 000,001,668 | ---- | C] () -- C:\Documents and Settings\Chris\Application Data\Microsoft\Internet Explorer\Quick Launch\PartyPoker.lnk
[2010.12.23 23:01:54 | 000,001,650 | ---- | C] () -- C:\Documents and Settings\Chris\Desktop\PartyPoker.lnk
[2010.12.23 17:38:30 | 000,001,604 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CDBurnerXP.lnk
[2010.12.23 17:38:24 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2010.12.22 23:45:09 | 000,000,847 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\MATLAB R2009b.lnk
[2010.12.22 23:43:32 | 000,002,362 | ---- | C] () -- C:\WINDOWS\System32\mscomct2.dep
[2010.12.22 23:43:09 | 000,645,120 | ---- | C] () -- C:\WINDOWS\System32\config.gms
[2010.12.22 19:08:37 | 000,001,542 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2010.12.22 18:45:23 | 000,001,604 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\QuickTime Player.lnk
[2010.12.21 15:42:35 | 000,175,546 | ---- | C] () -- C:\Documents and Settings\Chris\Desktop\GünzburgMehrfamilienhaus.pdf
[2010.12.20 11:02:44 | 000,270,903 | ---- | C] () -- C:\Documents and Settings\Chris\Desktop\römerstein.pdf
[2010.12.20 10:53:54 | 000,001,536 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Eraser.lnk
[2010.12.20 10:36:38 | 000,501,995 | ---- | C] () -- C:\Documents and Settings\Chris\Desktop\loipenplan07laichingen.pdf
[2010.12.20 10:35:58 | 000,839,939 | ---- | C] () -- C:\Documents and Settings\Chris\Desktop\loipenbeschr07-laichingen.pdf
[2010.12.20 10:33:39 | 002,156,297 | ---- | C] () -- C:\Documents and Settings\Chris\Desktop\Loipenplan-Blaubeuren.pdf
[2010.12.13 20:19:06 | 000,001,802 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SystemDiagnostics.lnk
[2010.12.09 19:13:41 | 004,713,472 | ---- | C] () -- C:\Documents and Settings\Chris\Desktop\New Microsoft Word-Dokument.doc
[2010.12.05 18:50:05 | 144,596,243 | ---- | C] () -- C:\Documents and Settings\Chris\Desktop\nitesswmv.wmv
[2010.09.24 13:53:44 | 000,006,936 | ---- | C] () -- C:\WINDOWS\System32\EvOnlDiag.dll
[2010.06.03 11:44:04 | 000,000,032 | ---- | C] () -- C:\WINDOWS\Menu.INI
[2010.05.06 20:27:28 | 000,006,053 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\AntLog.txt
[2010.03.25 22:55:14 | 000,028,672 | ---- | C] () -- C:\Documents and Settings\Chris\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.03.10 19:28:55 | 000,002,026 | ---- | C] () -- C:\WINDOWS\ATICIM.INI
[2010.03.10 17:41:31 | 000,093,718 | ---- | C] () -- C:\WINDOWS\VGAsetup.ini
[2010.03.09 18:37:51 | 000,081,177 | ---- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2010.02.20 09:03:29 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\setuplib.dll
[2010.01.24 10:27:41 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010.01.23 16:53:18 | 000,000,169 | ---- | C] () -- C:\WINDOWS\RtlRack.ini
[2010.01.23 16:52:16 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
[2010.01.23 16:52:10 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2010.01.19 21:47:37 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004.08.04 13:00:00 | 000,755,200 | ---- | C] () -- C:\WINDOWS\System32\ir50_32.dll
[2004.08.04 13:00:00 | 000,338,432 | ---- | C] () -- C:\WINDOWS\System32\ir41_qcx.dll
[2004.08.04 13:00:00 | 000,200,192 | ---- | C] () -- C:\WINDOWS\System32\ir50_qc.dll
[2004.08.04 13:00:00 | 000,183,808 | ---- | C] () -- C:\WINDOWS\System32\ir50_qcx.dll
[2004.08.04 13:00:00 | 000,120,320 | ---- | C] () -- C:\WINDOWS\System32\ir41_qc.dll
 
========== LOP Check ==========
 
[2010.01.23 17:28:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\elsterformular
[2010.12.23 17:38:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2010.01.23 17:28:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\elsterformular
[2010.02.09 18:48:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2010.10.03 17:42:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UAB
[2010.05.22 10:08:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010.02.20 09:50:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2010.06.13 16:20:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Amazon
[2010.06.02 20:57:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\AnvSoft
[2010.12.23 17:38:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Canneverbe Limited
[2010.01.24 10:00:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\elsterformular
[2010.06.13 16:40:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Mp3tag
[2010.11.07 16:18:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Subversion
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
[2010.01.24 10:13:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2010.01.24 10:17:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Adobe Systems
[2010.02.20 13:27:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple
[2010.02.20 09:49:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Apple Computer
[2010.01.19 21:49:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Avira
[2010.12.23 17:38:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Canneverbe Limited
[2010.01.23 17:28:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\elsterformular
[2010.10.07 20:56:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\McAfee
[2010.12.11 16:44:18 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2010.02.09 18:48:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2010.06.02 11:11:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Sun
[2010.10.03 17:42:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UAB
[2010.01.21 20:19:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2010.05.22 10:08:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010.02.20 09:50:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
[2009.02.04 13:56:14 | 000,075,112 | ---- | M] (GEAR Software, Inc.) -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}\x86\DifXInstall32.exe
[2010.12.22 18:09:57 | 000,073,000 | ---- | M] (Apple Inc.) -- C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 10.1.1.4\SetupAdmin.exe
 
< %APPDATA%\*. >
[2010.01.24 10:17:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Adobe
[2010.02.20 10:19:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\AdobeUM
[2010.06.13 16:20:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Amazon
[2010.06.02 20:57:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\AnvSoft
[2010.02.20 13:42:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Apple Computer
[2010.12.23 17:38:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Canneverbe Limited
[2010.12.26 20:27:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\dvdcss
[2010.01.24 10:00:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\elsterformular
[2010.01.19 21:04:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Identities
[2010.01.24 09:57:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\InstallShield
[2010.01.21 20:01:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Macromedia
[2010.01.24 13:19:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\MathWorks
[2010.12.11 17:03:44 | 000,000,000 | --SD | M] -- C:\Documents and Settings\Chris\Application Data\Microsoft
[2010.10.03 17:41:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Mozilla
[2010.12.23 23:05:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Mozilla-Cache
[2010.06.13 16:40:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Mp3tag
[2010.11.07 16:18:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Subversion
[2010.06.02 11:07:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\Sun
[2010.11.07 17:50:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\TortoiseSVN
[2010.12.26 21:09:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\vlc
[2010.01.31 12:47:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Chris\Application Data\WinRAR
 
< %APPDATA%\*.exe /s >
[2010.04.18 13:33:56 | 000,307,200 | ---- | M] (Simon Tatham) -- C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\wur7pojb.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\psftp.exe
[2010.04.18 13:33:56 | 000,172,032 | ---- | M] (Simon Tatham) -- C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\wur7pojb.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\puttygen.exe
 
< %SYSTEMDRIVE%\*.exe >
 
 
< MD5 for: AGP440.SYS  >
[2004.08.04 13:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2010.01.21 20:35:06 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2010.01.21 20:35:06 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
 
< MD5 for: ATAPI.SYS  >
[2004.08.04 13:00:00 | 018,738,937 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2010.01.21 20:35:06 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2010.01.21 20:35:06 | 023,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
[2004.08.04 13:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
 
< MD5 for: EVENTLOG.DLL  >
[2007.01.23 16:22:16 | 000,032,890 | ---- | M] () MD5=4FA5D1120762802A741F374F8B391E69 -- C:\Program Files\MATLAB\R2009b\sys\perl\win32\lib\auto\Win32\EventLog\EventLog.dll
[2008.04.14 01:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008.04.14 01:11:53 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
[2004.08.04 13:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
 
< MD5 for: EXPLORER.EXE  >
[2008.04.14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
[2008.04.14 01:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2004.08.04 13:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
 
< MD5 for: NETLOGON.DLL  >
[2008.04.14 01:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008.04.14 01:12:01 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
[2004.08.04 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
 
< MD5 for: SCECLI.DLL  >
[2004.08.04 13:00:00 | 000,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008.04.14 01:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008.04.14 01:12:05 | 000,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.04.14 01:12:08 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\ServicePackFiles\i386\user32.dll
[2008.04.14 01:12:08 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=B26B135FF1B9F60C9388B4A7D16F600B -- C:\WINDOWS\system32\user32.dll
[2004.08.04 13:00:00 | 000,577,024 | ---- | M] (Microsoft Corporation) MD5=C72661F8552ACE7C5C85E16A3CF505C4 -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2004.08.04 13:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008.04.14 01:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008.04.14 01:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2004.08.04 13:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008.04.14 01:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008.04.14 01:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2004.08.04 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys
[2004.08.04 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
[2010.01.19 21:43:51 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2010.01.19 21:43:51 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2010.01.19 21:43:51 | 000,909,312 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.03.08 04:31:44 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll
[2009.03.08 04:31:38 | 000,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll
[2010.11.06 01:26:57 | 000,184,320 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\iepeers.dll
[3 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< End of report >
         

--- --- ---





extras.txt

OTL Logfile:

OTL Extras logfile created on: 27.12.2010 16:31:03 - Run 1
OTL by OldTimer - Version 3.2.18.0     Folder = C:\Documents and Settings\Chris\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Germany | Language: DEU | Date Format: dd.MM.yyyy
 
1.022,00 Mb Total Physical Memory | 335,00 Mb Available Physical Memory | 33,00% Memory free
2,00 Gb Paging File | 2,00 Gb Available in Paging File | 68,00% Paging File free
Paging file location(s): C:\pagefile.sys 1488 2976 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 44,20 Gb Free Space | 59,32% Space Free | Partition Type: NTFS
Drive D: | 425,99 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive G: | 1,86 Gb Total Space | 1,83 Gb Free Space | 98,23% Space Free | Partition Type: FAT
 
Computer Name: CHRIS-FUJI | User Name: Chris | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
 
[HKEY_USERS\S-1-5-21-1409082233-1303643608-682003330-1003\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\GigaTribe\gigatribe.exe" = C:\Program Files\GigaTribe\gigatribe.exe:*:Enabled:GigaTribe -- File not found
"C:\Program Files\VideoLAN\VLC\vlc.exe" = C:\Program Files\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
"C:\Program Files\eMule\emule.exe" = C:\Program Files\eMule\emule.exe:*:Enabled:eMule -- (eMule-Project.net - Official eMule Homepage. Downloads, Help, Docu, News...)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0AABB202-9D70-43BA-897E-AFF9469318B6}" = Ant.com IE add-on
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{392A74D0-4DFE-49F7-87C3-8A61708F8856}" = Eraser 6.0.8.2273
"{4640FDE1-B83A-4376-84ED-86F86BEE2D41}" = Driver Detective
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E5735B7-4E27-4A8C-80DD-1D12880128CA}" = AWLAN-N2
"{52B97218-98CB-4B8B-9283-D213C85E1AA4}" = Windows Live Anmelde-Assistent
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{80B0B731-5FAE-475D-8844-20F46373780D}" = SystemDiagnostics
"{881F5DE8-9367-4B81-A325-E91BBC6472F9}" = iTunes
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel
"{AC76BA86-1033-F400-7760-000000000002}" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch
"{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}" = REALTEK GbE & FE Ethernet PCI NIC Driver
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C301D681-00D3-4597-8446-3DE54FE20F1A}" = TortoiseSVN 1.6.11.20210 (32 bit)
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{DC226AC9-0314-496C-BE6A-B6A132628466}" = SiSAGP driver
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FDEC8D4C-FF2B-4F10-BF1E-4AEDCB98D4A9}" = Mediachase Screen Capture
"Adobe Acrobat 7.0 Professional - EFG" = Adobe Acrobat 7.0 Professional - English, Français, Deutsch
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.9
"Ant.com IE add-on" = Ant.com IE add-on
"Any Video Converter_is1" = Any Video Converter 3.0.5
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"ElsterFormular  ***unknown variable buildnummer***" = ElsterFormular 
"eMule" = eMule
"Free CD to MP3 Converter" = Free CD to MP3 Converter
"ie8" = Windows Internet Explorer 8
"MatlabR2009b" = MATLAB R2009b
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.10)" = Mozilla Firefox (3.6.10)
"Mp3tag" = Mp3tag v2.46a
"NVIDIA Drivers" = NVIDIA Drivers
"PartyPoker" = PartyPoker
"SiS VGA Driver" = SiS VGA Utilities
"VLC media player" = VLC media player 1.0.3
"VLC Setup Helper_is1" = VLC Setup Helper 3.01
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 31.10.2010 12:57:35 | Computer Name = CHRIS-FUJI | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 453328
 
Error - 31.10.2010 12:57:35 | Computer Name = CHRIS-FUJI | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 453328
 
Error - 07.11.2010 13:06:09 | Computer Name = CHRIS-FUJI | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module
 hungapp, version 0.0.0.0, hang address 0x00000000.
 
Error - 13.12.2010 14:29:13 | Computer Name = CHRIS-FUJI | Source = Application Hang | ID = 1002
Description = Hanging application msimn.exe, version 6.0.2900.5512, hang module 
hungapp, version 0.0.0.0, hang address 0x00000000.
 
Error - 17.12.2010 16:35:59 | Computer Name = CHRIS-FUJI | Source = Application Error | ID = 1000
Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting
 module srchui.dll, version 1.0.0.5326, fault address 0x0000a47b.
 
Error - 20.12.2010 05:33:07 | Computer Name = CHRIS-FUJI | Source = Application Error | ID = 1000
Description = Faulting application acrobat.exe, version 7.0.0.1333, faulting module
 escript.api, version 7.0.0.1333, fault address 0x0002370b.
 
Error - 23.12.2010 18:04:30 | Computer Name = CHRIS-FUJI | Source = Application Error | ID = 1000
Description = Faulting application pprekop.exe, version 4.2.0.172, faulting module
 ole32.dll, version 5.1.2600.2182, fault address 0x10017bed.
 
Error - 25.12.2010 14:08:06 | Computer Name = CHRIS-FUJI | Source = Application Hang | ID = 1002
Description = Hanging application emule.exe, version 0.50.0.4, hang module hungapp,
 version 0.0.0.0, hang address 0x00000000.
 
Error - 25.12.2010 14:08:21 | Computer Name = CHRIS-FUJI | Source = Application Hang | ID = 1002
Description = Hanging application vlc.exe, version 1.0.3.0, hang module hungapp,
 version 0.0.0.0, hang address 0x00000000.
 
Error - 26.12.2010 07:44:59 | Computer Name = CHRIS-FUJI | Source = Application Hang | ID = 1002
Description = Hanging application QuickTimePlayer.exe, version 7.69.80.9, hang module
 hungapp, version 0.0.0.0, hang address 0x00000000.
 
[ System Events ]
Error - 23.12.2010 12:22:27 | Computer Name = CHRIS-FUJI | Source = Cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.
 
Error - 23.12.2010 12:22:28 | Computer Name = CHRIS-FUJI | Source = Cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.
 
Error - 23.12.2010 12:22:30 | Computer Name = CHRIS-FUJI | Source = Cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.
 
Error - 23.12.2010 12:22:30 | Computer Name = CHRIS-FUJI | Source = Cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.
 
Error - 23.12.2010 12:22:32 | Computer Name = CHRIS-FUJI | Source = Cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.
 
Error - 23.12.2010 12:22:33 | Computer Name = CHRIS-FUJI | Source = Cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.
 
Error - 23.12.2010 12:22:34 | Computer Name = CHRIS-FUJI | Source = Cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.
 
Error - 23.12.2010 12:22:35 | Computer Name = CHRIS-FUJI | Source = Cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.
 
Error - 23.12.2010 12:22:35 | Computer Name = CHRIS-FUJI | Source = Cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.
 
Error - 23.12.2010 12:22:36 | Computer Name = CHRIS-FUJI | Source = Cdrom | ID = 262151
Description = The device, \Device\CdRom0, has a bad block.
 
 
< End of report >
         

--- --- ---

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
MOD - C:\WINDOWS\system32\ntbaycfg.dll ()
O36 - AppCertDlls: javanw16 - (C:\WINDOWS\system32\ntbaycfg.dll) - C:\WINDOWS\system32\ntbaycfg.dll ()
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort posten.

öffne den arbeitsplatz, c: dann _OTL
dort rechtsklick auf moved files
wähle zu moved files.rar oder zip hinzufügen.
lade das archiv in unserem upload channel hoch.
http://www.trojaner-board.de/54791-a...ner-board.html

hier mal der Inhalt der txt Datei:

All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls\\javanw16:C:\WINDOWS\system32\ntbaycfg.dll deleted successfully.
C:\WINDOWS\system32\ntbaycfg.dll moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 802 bytes

User: All Users

User: Chris
->Flash cache emptied: 46366 bytes

User: Default User

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 970254 bytes
->Temporary Internet Files folder emptied: 92622812 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Chris
->Temp folder emptied: 201706301 bytes
->Temporary Internet Files folder emptied: 32798952 bytes
->Java cache emptied: 181731 bytes
->FireFox cache emptied: 4442844 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 36492 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 103120715 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2264683 bytes
%systemroot%\System32 .tmp files removed: 1387921 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 35497586 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 91272914 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 20735282 bytes

Total Files Cleaned = 560,00 mb


OTL by OldTimer - Version 3.2.18.0 log created on 12272010_195259

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

..die *rar Datei habe ich nun auch hochgeladen.

Vielen Dank für die schnelle Unterstützung!

Woher weis man denn welche Datei schuld ist ?

Ist mein System jetzt wieder Clean oder habe ich erstmal nur meinen Beitrag geleistet, dass die Sicherheitslücke durch die das Schadprogramm gestopft werden kann ?
Oder war ich selbst die größte Sicherheitslücke weil ich mein System nicht ausreichend geschützt habe ? .... Fragen über Fragen, aber ein interessantes Thema.
Unterstützung hier ist wirklich super ....

auch hier ist formatieren angesagt.
ich möchte dir, falls nichts dagegen hast, tipps mit auf den weg geben, die dir helfen, das system besser zu schützen

hm, klar gerne, bin für Tipps immer dankbar sowas in Zukunft zu vermeiden ...

hab ja net ganz den Durchblick, aber warum soll ich meine Festplatte formatieren ?
Habe mich gerade nochmal eingeloggt und die Aufforderung 10 TANs einzugeben kam nicht mehr ...

rufe die bank an, onlinebanking muss gesperrt werden.
dann senden die dir neue daten.
das formatieren ist das sicherste in diesem fall nur so bekommst du nen vertrauenswürdiges system.

- windows cd rein, formatieren, nicht die schnelle formatierung wählen!
- windows instalieren
- treiber instalieren.
- windows update seite aufsuchen, automatische updates aktivieren.
servicepack 3 internet explorer 8 + sonstigen updates drauf.
dep für alle prozesse:
Datenausführungsverhinderung (DEP)
• "Datenausführungsverhinderung für alle Programme und Dienste mit Ausnahme der ausgewählten einschalten:".
wenn es zu problemen kommen sollte, kann man die betroffenen prozesse aus der Überwachung entfernen.
falls du avira nutzen willst, können wirs besser konfigurieren
avira genauestens nach anleitung instalieren:
http://www.trojaner-board.de/54192-a...tellungen.html
achte darauf, das der auftrag im planer wirklich über lokale laufwerke läuft, sonst werden scan einstellungen nicht gültig.
unter avira, konfiguration, guard, autostart, haken raus lassen.

als browser solltest du den opera nutzen, er ist sicherer und schneller.
wenn er dir nicht gefällt passe ich meine anleitung für den ff an.
Opera Webbrowser | Schneller & sicherer | Die neuen Internet-Browser kostenlos herunterladen
mit diesem tool lässt sich ein werbeblocker laden
mit diesem tool lässt sich ein werbeblocker laden
Opera URLFilter Downloader ? OperaWiki
dies sollte 1x pro woche durchgeführt werden.
zusätzlich kannst du das auch manuell erledigen, falls mal etwas nicht geblockt wird:
Computerbase - Werbung blockieren
auch diese tutorial seite mal ansehen.
Opera Tutorial- Übersicht
hier besonders die abschnitte sicherheit (kookies) und passwort durchlesen


um das surfen sicherer zu machen, würde ich Sandboxie empfehlen.
Download:
Drop.io
(als pdf)
und ein vidio zum besseren verständniss:
hier noch ein paar zusatzeinstellungen, nicht verunsichern lassen, wenn du das programm instaliert hast, werden sie klar.
den direkten datei zugriff bitte auf opera beschrenken,
bei
Internetzugriff:
opera.exe
öffne dann sandboxie, dann oben im menü auf sandbox klickem, wähle deine sandbox aus und klicke dann auf sandboxeinstellung.
dort auf anwendung, webbrowser, andere dort auf direkten zugriff auf opera bookmarks erlauben. dann auf hinzufügen und ok.
somit kannst du deine lesezeichen auch in der sandbox dauerhaft abspeichern.

wenn du mit dem programm gut auskommst, ist ne lizenz zu empfehlen.
1. es gibt dann noch ein paar mehr funktionen.
2. kommt nach nem monat die anzeige, dass das programm freeware ist, die verschwindet erst nach ner zeit, find ich n bissel nerfig.
3. ist die lizenz lebenslang gültig, kostenpunkt rund 30 €, und du kannst sie auf allen pcs in deinem haushalt einsetzen.

autorun deaktivieren:
über diesen weg werden sehr häufig schaddateien verbreitet, schalte die funktion also ab.
Tipparchiv - Autorun/Autoplay gezielt für Laufwerkstypen oder -buchstaben abschalten - WinTotal.de
usb sticks, festplatten etc, sollte man mit panda vaccine impfen:
ANTIMALWARE: Panda USB Vaccine - Download FREE - PANDA SECURITY
so holt man sich keine infektionen ins haus, wenn man mal die festplatte etc verleit.
hake an:
run panda usb vaccine automatically when computer boots
automatically vaccine any new insert usb key
enable ntfs file suport

Updates sind für dein system genauso wichtig, wie ein antivirenscanner. Sehr häufig gelangen schädlinge nur aufs system, weil der user veraltete software nutzt.
instaliere die folgenden update checker.
Secunia:
http://www.trojaner-board.de/83959-s...ector-psi.html
und file hippo update checker:
FileHippo.com Update Checker - FileHippo.com
das file Hippo Symbol wird im infobereich neben der uhr auftauchen, mache bitte nen rechtsklick darauf, wähle settings, results, setze einen haken bei "hide beta updates" klicke ok.
dann doppelklicke file hippo, eine Internetseite wird geöffnet, auf der dier die aktuellsten updates gezeigt werden, diese downloaden und instalieren.

Beide programme sollten im autostart bleiben, und sobald eines der programme updates anzeigt sollten diese umgehend instaliert werden.


achtung:
bei einigen programmen werden englische setups angeboten. das sollte man ersehen können, die setupdateien sollten ein .en oder .us enthalten. wenn dem so ist, sollte man beim hersteller schauen, dort gibts die deutschen setups zu laden.
Falls du die hersteller seite nicht kennst, google wird bestimmt behilflich sein :-)

regelmäßige Backups des systems sind sehr wichtig, du weist nie, ob deine festplatte mal kaputt geht.
Paragon Backup & Recovery Free Edition - Das Produkt
außerdem kannst du, bei neuerlichem malware befall das system zurücksetzen.
Das Backup sollte möglichst auf eine externe festplatte etc emacht werden, nicht auf die selbe, wo sich die zu sichernden daten befinden.
Von sehr wichtigen Daten könnte man noch eine zusätzliche Sicherung auf dvds/cds erstellen, dazu könnte man auch wiederbeschreibbare verwenden (rws) falls die sammlung mal erneuert werden soll.



allgemeines.
- verzichte auf tuning programme, sie bringen nichts.
- keine illegalen downloads.
90 % bringen malware mit sich!
- keine streaming seiten wie kino.to sie verbreiten malware.
- wenn möglich, instalationen immer benutzerdefiniert ausführen, dann kannst du unnötiges zeug abwählen.
- programme patches etc immer nur vom hersteller direkt laden.
online banking:

ich würde zu online banking mit chipcard raten, dazu benötigst du, ein lesegerät, lasse dich von deiner bank beraten, es sollte aber mindestens ein klasse2 lesegerät sein, besser sogar ein klasse3 leser, das sind die besten für den privat kunden.
Kartenlesegerät ? Wikipedia

instaliere jetzt die von dir benötigten programme.
endere alle passwörter.
surfe nur noch in der sandbox, mit klick auf sandboxed web browser.

Hi,
bin grad dabei die beschriebenene Schritte durchzuführen.
BHänge an Sandboxie weil Drop.io Link nicht mehr geht. Kannst du mir einen anderen Link geben oder die Daten vielleicht per Mail schicken ?

Danke,
Chris

ja sorry
Sandbox*Einstellungen |
da ist er.

Hallo,

nochmal danke für die Unterstützung !

Bin soweit mit allen Tipps durch, aber ein Problem habe ich noch.

Ich hab zuerst Avira eingerichtet. Wenn ich nun meine USB Festplatte mit Panda impfen will blokiert Avira den Zugriff auf Autorun.inf.

Schönes neues Jahr !

Chris

gehe mal in die avira konfiguration, dort auf guard und da müsste es autostart oder etwas ähnliches geben, da kannst du die beiden haken raus nehmen und avira sollte die autorun datei nicht mehr blocken