Hallo habe auch den Troianer eingefangen.

Wer kann mir helfen?

Danke im voraus

Extras.txt ist:

OTL Extras logfile created on: 28.04.2011 14:31:41 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Dokumente und Einstellungen\Benni\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 60,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINXP | %ProgramFiles% = C:\Programme
Drive C: | 29,29 Gb Total Space | 5,70 Gb Free Space | 19,48% Space Free | Partition Type: NTFS
Drive D: | 31,98 Gb Total Space | 13,49 Gb Free Space | 42,18% Space Free | Partition Type: NTFS
Drive E: | 87,77 Gb Total Space | 35,00 Gb Free Space | 39,87% Space Free | Partition Type: NTFS

Computer Name: BIE | User Name: Benni | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "C:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft)
Directory [Winamp.Enqueue] -- "C:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft)
Directory [Winamp.Play] -- "C:\Programme\Winamp\winamp.exe" "%1" (Nullsoft)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
"DisableUnicastResponsesToMulticastBroadcast" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
"DisableUnicastResponsesToMulticastBroadcast" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\ICQ6\ICQ.exe" = C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6
"C:\Programme\eMule\emule.exe" = C:\Programme\eMule\emule.exe:*:Enabled:eMule
"C:\WINXP\system32\dpvsetup.exe" = C:\WINXP\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation)
"G:\Rest\Programme\eMule\emule.exe" = G:\Rest\Programme\eMule\emule.exe:*:Enabled:eMule
"C:\Programme\ICQ6.5\ICQ.exe" = C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6 -- (ICQ, LLC.)
"C:\WINXP\Explorer.EXE" = C:\WINXP\Explorer.EXE:*:Enabled:enable -- (Microsoft Corporation)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{0224CACC-994D-45F8-B973-D65056EA9C2F}" = Adobe XMP DVA Panels CS3
"{04B45310-A5FE-4425-BFCA-1A6D8920DE74}" = OpenOffice.org 3.0
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0C34B801-6AEC-4667-B053-03A67E2D0415}" = Apple Application Support
"{13F00518-807A-4B3A-83B0-A7CD90F3A398}" = MarketResearch
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{185D0A67-E066-44AE-926D-F6305813301C}" = Adobe After Effects CS3 Presets
"{1E187923-04E5-4E1F-9BF2-40E32D93A1C4}" = HP Color LaserJet CP1210 Series Toolbox
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26DDB12A-CB5E-4C0B-89AF-817CA0E59CC9}" = HP LaserJet Toolbox
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{2CCBABCB-6427-4A55-B091-49864623C43F}" = Google Toolbar for Firefox
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{50F102CA-4BE2-41A9-9810-5BB05EB91B9A}" = Adobe Premiere Pro CS3 Functional Content
"{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings
"{54360A73-B080-4A69-BFD4-53C190DD3AB0}" = HP Color LaserJet CP1210 Series
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{60DE4033-9503-48D1-A483-7846BD217CA9}" = ICQ6.5
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6B708481-748A-4EB4-97C1-CD386244FF77}" = Adobe MotionPicture Color Files
"{6BBAA81D-6A7E-43AD-8889-2F002DCAAFDD}" = AHV content for Acrobat and Flash
"{6E06A57A-6728-4CFB-AA9A-5149F9C9ADB3}" = ATI Catalyst Control Center
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7902E313-FF0F-4493-ACB1-A8147B78DCD0}" = HPSSupply
"{7ACFB90E-8FD0-4397-AD3A-5195412623A3}" = Adobe Help Viewer CS3
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{80C13322-2085-49F5-8B19-2A9FA20F14E9}" = Adobe After Effects CS3 Template Projects & Footage
"{845A8DB9-8802-4FD3-9FE3-938A6C46A2EC}" = Adobe Video Profiles
"{8A508AAA-3B69-4326-B89E-A6166FA05D3C}" = Canon MultiPASS Suite 4.40
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings
"{9811A185-3D3D-11D6-9E14-00036D172B00}" = Adobe MPEG Encoder
"{993960EE-CA4D-443F-8F88-E24260DD5FD2}" = LG PC Suite
"{9BA4F9C5-7CB4-492C-9B97-89E36AFA0AB9}" = Adobe Setup
"{9C09E3A4-850A-40B2-B94F-EBFB5349C238}" = hppusgCP1215
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
"{A82D052A-0806-42DF-80CD-1730A1AC0ED3}" = MrvlUsgTracking
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B671CBFD-4109-4D35-9252-3062D3CCB7B2}" = Adobe SING CS3
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B73CFB12-C814-4638-AFFD-7E3AAFAF0B4E}" = Adobe BridgeTalk Plugin CS3
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BB85ED9C-AFC9-43BD-B8DC-258C3C7DF72E}" = HP Software Update
"{BC4F8E84-5E29-49EC-B4E7-E6F9CB50986C}" = Adobe Flash Player 9 ActiveX
"{BCB313A5-1AD0-4829-9D6F-EB41C3CFCD4B}" = Phase 5 HTML-Editor
"{BE5F3842-8309-4754-92D5-83E02E6077A3}" = Adobe Extension Manager CS3
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2
"{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem driver
"{C5BD220A-EFE8-48A5-B70E-9503D535FACE}" = Adobe WAS CS3
"{C950420B-4182-49EA-850A-A6A2ABF06C6B}" = Marvell Miniport Driver
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{DA34FE93-5DC5-48E0-ACC8-A5389E05BB51}" = iTunes
"{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{EA7B3CC4-366D-4CF6-8350-FD7A7034116E}" = Adobe InDesign CS3 Icon Handler
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe_8bb24e071e5922899698c2105557bd2" = Add or Remove Adobe Creative Suite 3 Master Collection
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"ANSTOSS 2" = ANSTOSS 2
"ASAPI Update" = ASAPI Update
"Audacity_is1" = Audacity 1.2.6
"Audiograbber" = Audiograbber 1.83 SE
"Audiograbber-Lame" = Audiograbber Lame-MP3-Plugin
"AudioRecorder" = AudioRecorder
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"EDIROL FA-66 Driver Setup" = EDIROL FA-66 Driver
"FileZilla Client" = FileZilla Client 3.0.11
"Firebird SQL Server D" = Firebird SQL Server - MAGIX Edition
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.6
"HP Color LaserJet CP1210 Series" = HP Color LaserJet CP1210 Series
"IrfanView" = IrfanView (remove only)
"LastFM_is1" = Last.fm 1.5.4.24567
"MAGIX Goya burnR D" = MAGIX Goya burnR 1.3.1.3 (D)
"MAGIX Screenshare D" = MAGIX Screenshare 4.3.6.1987 (D)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.0.19)" = Mozilla Firefox (3.0.19)
"Native Instruments - Rig Kontrol 3 Driver" = Native Instruments - Rig Kontrol 3 Driver
"Native Instruments Guitar Rig 3" = Native Instruments Guitar Rig 3
"Native Instruments Service Center" = Native Instruments Service Center
"Nero8Lite_is1" = Nero 8 Lite 8.3.2.1
"Prism" = Prism Video Converter
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"RNCompiler 6.0" = Advanced RealMedia Export Plug-in for Premiere 6.0
"Samplitude Music Studio 15 D" = Samplitude Music Studio 15 15.0.1.0 (D)
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"Steinberg Cubase VST32" = Steinberg Cubase VST32
"Steinberg WaveLab 5.00a" = Steinberg WaveLab 5.00a
"TCEssentials" = TC Native Essentials 2.02
"Uninstall_is1" = Uninstall 1.0.0.1
"VideoPad" = VideoPad Video Editor
"VLC media player" = VLC media player 1.1.8
"Winamp" = Winamp
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 02.10.2009 16:47:21 | Computer Name = BIE | Source = MsiInstaller | ID = 10005
Description = Product: Adobe Premiere Pro CS3 Third Party Content -- Please install
Adobe Premiere Pro CS3 Third Party Content using Setup.exe

Error - 24.02.2010 04:51:02 | Computer Name = BIE | Source = MsiInstaller | ID = 10005
Description = Product: HPCarePackCore -- HP Care Pack Services is supported only
for "United States" location .

Error - 24.02.2010 04:51:03 | Computer Name = BIE | Source = MsiInstaller | ID = 10005
Description = Product: HPCarePackProducts -- HP Care Pack Products is supported
only for "United States" location .

Error - 05.03.2010 11:48:54 | Computer Name = BIE | Source = Avira AntiVir | ID = 4118
Description = AUSNAHMEFEHLER beim Aufruf der Funktion für die Datei G:\seite 3 07.JPG.

[ACCESS_VIOLATION Exception!! EIP = 27963640] Bitte Avira informieren und die obige
Datei übersenden!

Error - 13.03.2010 19:28:24 | Computer Name = BIE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung divx player.exe, Version 6.8.2.1, fehlgeschlagenes
Modul msvcrt.dll, Version 7.0.2600.5512, Fehleradresse 0x000370dc.

Error - 12.04.2010 06:31:18 | Computer Name = BIE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
Modul , Version 0.0.0.0, Fehleradresse 0x00000000.

Error - 16.04.2010 08:41:14 | Computer Name = BIE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes
Modul , Version 0.0.0.0, Fehleradresse 0x00000000.

Error - 14.05.2010 05:54:35 | Computer Name = BIE | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung wavelab-app.exe, Version 5.0.0.221, fehlgeschlagenes
Modul unknown, Version 0.0.0.0, Fehleradresse 0x7e42b9a2.

Error - 11.07.2010 05:30:13 | Computer Name = BIE | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
in der signierten Datei. .

Error - 11.07.2010 05:30:13 | Computer Name = BIE | Source = crypt32 | ID = 131083
Description = Die Extrahierung der Drittanbieterstammlisten aus der automatischen
Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
ist fehlgeschlagen mit dem Fehler: Ein erforderliches Zertifikat befindet sich
nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel
in der signierten Datei. .

[ System Events ]
Error - 24.04.2011 12:16:56 | Computer Name = BIE | Source = Service Control Manager | ID = 7023
Description = Der Dienst "SSHNAS" wurde mit folgendem Fehler beendet: %%126

Error - 26.04.2011 06:56:44 | Computer Name = BIE | Source = Service Control Manager | ID = 7023
Description = Der Dienst "SSHNAS" wurde mit folgendem Fehler beendet: %%126

Error - 26.04.2011 06:57:03 | Computer Name = BIE | Source = Windows Update Agent | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x8007f0f1 fehlgeschlagen: Sicherheitsupdate für Internet Explorer 7 unter
Windows XP (KB938127)

Error - 26.04.2011 14:16:25 | Computer Name = BIE | Source = Service Control Manager | ID = 7023
Description = Der Dienst "SSHNAS" wurde mit folgendem Fehler beendet: %%126

Error - 26.04.2011 14:42:22 | Computer Name = BIE | Source = Service Control Manager | ID = 7023
Description = Der Dienst "SSHNAS" wurde mit folgendem Fehler beendet: %%126

Error - 27.04.2011 02:43:36 | Computer Name = BIE | Source = Service Control Manager | ID = 7023
Description = Der Dienst "SSHNAS" wurde mit folgendem Fehler beendet: %%126

Error - 27.04.2011 02:43:59 | Computer Name = BIE | Source = Windows Update Agent | ID = 20
Description = Installationsfehler: Die Installation des folgenden Updates ist mit
Fehler 0x8007f0f1 fehlgeschlagen: Sicherheitsupdate für Internet Explorer 7 unter
Windows XP (KB938127)

Error - 27.04.2011 04:45:34 | Computer Name = BIE | Source = Service Control Manager | ID = 7023
Description = Der Dienst "SSHNAS" wurde mit folgendem Fehler beendet: %%126

Error - 27.04.2011 11:39:57 | Computer Name = BIE | Source = Service Control Manager | ID = 7023
Description = Der Dienst "SSHNAS" wurde mit folgendem Fehler beendet: %%126

Error - 28.04.2011 06:54:13 | Computer Name = BIE | Source = Service Control Manager | ID = 7023
Description = Der Dienst "SSHNAS" wurde mit folgendem Fehler beendet: %%126


< End of report >


OTL.txt

OTL logfile created on: 28.04.2011 14:31:41 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Dokumente und Einstellungen\Benni\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 60,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 83,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINXP | %ProgramFiles% = C:\Programme
Drive C: | 29,29 Gb Total Space | 5,70 Gb Free Space | 19,48% Space Free | Partition Type: NTFS
Drive D: | 31,98 Gb Total Space | 13,49 Gb Free Space | 42,18% Space Free | Partition Type: NTFS
Drive E: | 87,77 Gb Total Space | 35,00 Gb Free Space | 39,87% Space Free | Partition Type: NTFS

Computer Name: BIE | User Name: Benni | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Dokumente und Einstellungen\Benni\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\kmQvQcUSBfWiJhv.exe (WinTrust)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Programme\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Programme\OpenOffice.org 3\program\swriter.exe ()
PRC - C:\WINXP\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Adobe\Reader 8.0\Reader\AcroRd32.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Canon\MultiPASS4\mpservic.exe (Canon Inc.)
PRC - C:\WINXP\system32\devldr32.exe (Creative Technology Ltd.)


========== Modules (SafeList) ==========

MOD - C:\Dokumente und Einstellungen\Benni\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINXP\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (SSHNAS) -- File not found
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (FLEXnet Licensing Service) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.)
SRV - (FirebirdServerMAGIXInstance) -- C:\Programme\MAGIX\Common\Database\bin\fbserver.exe (MAGIX®)
SRV - (MpService) -- C:\Programme\Canon\MultiPASS4\mpservic.exe (Canon Inc.)


========== Driver Services (SafeList) ==========

DRV - (avipbb) -- C:\WINXP\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINXP\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINXP\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (acedrv11) -- C:\WINXP\system32\drivers\acedrv11.sys (Protect Software GmbH)
DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\WINXP\system32\drivers\s0016unic.sys (MCCI Corporation)
DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\WINXP\system32\drivers\s0016nd5.sys (MCCI Corporation)
DRV - (s0016mdfl) -- C:\WINXP\system32\drivers\s0016mdfl.sys (MCCI Corporation)
DRV - (s0016mdm) -- C:\WINXP\system32\drivers\s0016mdm.sys (MCCI Corporation)
DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\WINXP\system32\drivers\s0016mgmt.sys (MCCI Corporation)
DRV - (s0016obex) -- C:\WINXP\system32\drivers\s0016obex.sys (MCCI Corporation)
DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\WINXP\system32\drivers\s0016bus.sys (MCCI Corporation)
DRV - (ati2mtag) -- C:\WINXP\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (NwlnkIpx) -- C:\WINXP\system32\drivers\nwlnkipx.sys (Microsoft Corporation)
DRV - (gameenum) -- C:\WINXP\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (UsbDiag) -- C:\WINXP\system32\drivers\lgusbdiag.sys (LG Electronics Inc.)
DRV - (USBModem) -- C:\WINXP\system32\drivers\lgusbmodem.sys (LG Electronics Inc.)
DRV - (usbbus) -- C:\WINXP\system32\drivers\lgusbbus.sys (LG Electronics Inc.)
DRV - (rrau0002) -- C:\WINXP\system32\drivers\rrau0002.sys (BridgeCo AG)
DRV - (rrwd0002) -- C:\WINXP\system32\drivers\rrwd0002.sys (BridgeCo AG)
DRV - (yukonwxp) -- C:\WINXP\system32\drivers\yukonwxp.sys (Marvell Semiconductor Inc.)
DRV - (ASPI) -- C:\WINXP\system32\drivers\ASPI32.SYS (Adaptec)
DRV - (Asapi) -- C:\WINXP\System32\drivers\asapi.sys (VOB Computersysteme GmbH)
DRV - (NwlnkNb) -- C:\WINXP\system32\drivers\nwlnknb.sys (Microsoft Corporation)
DRV - (NwlnkSpx) -- C:\WINXP\system32\drivers\nwlnkspx.sys (Microsoft Corporation)
DRV - (ENUM1394) -- C:\WINXP\system32\drivers\enum1394.sys (Microsoft Corporation)
DRV - (sfman) Creative-SoundFont-Verwaltungstreiber (WDM) -- C:\WINXP\system32\drivers\sfmanm.sys (Creative Technology Ltd.)
DRV - (emu10k1) Creative-Schnittstellen-Verwaltungstreiber (WDM) -- C:\WINXP\system32\drivers\ctlfacem.sys (Creative Technology Ltd.)
DRV - (emu10k) Creative SB Live! (WDM) -- C:\WINXP\system32\drivers\emu10k1m.sys (Creative Technology Ltd.)
DRV - (ctljystk) -- C:\WINXP\system32\drivers\ctljystk.sys (Creative Technology Ltd.)
DRV - (Nsynas32) -- C:\WINXP\System32\drivers\NSynas32.sys (Syncrosoft Hard- und Software GmbH)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINXP\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: finder@meingutscheincode.de:2.0
FF - prefs.js..extensions.enabledItems: {40c3cc16-7269-4b32-9531-17f2950fb06f}:2.5.8.6


FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\Programme\Mozilla Firefox\components [2010.07.01 15:55:05 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2010.04.08 22:19:45 | 000,000,000 | ---D | M]

[2008.08.18 22:55:12 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\Benni\Anwendungsdaten\Mozilla\Extensions
[2011.04.28 13:04:47 | 000,000,000 | -H-D | M] (No name found) -- C:\Dokumente und Einstellungen\Benni\Anwendungsdaten\Mozilla\Firefox\Profiles\adv4zyxe.default\extensions
[2011.04.12 09:48:04 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Benni\Anwendungsdaten\Mozilla\Firefox\Profiles\adv4zyxe.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.04.04 13:48:34 | 000,000,000 | -H-D | M] (Winload Toolbar) -- C:\Dokumente und Einstellungen\Benni\Anwendungsdaten\Mozilla\Firefox\Profiles\adv4zyxe.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f}
[2010.07.26 12:30:23 | 000,000,000 | -H-D | M] ("DVDVideoSoft Menu") -- C:\Dokumente und Einstellungen\Benni\Anwendungsdaten\Mozilla\Firefox\Profiles\adv4zyxe.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.04.04 13:48:33 | 000,000,000 | -H-D | M] (Mein Gutscheincode Finder) -- C:\Dokumente und Einstellungen\Benni\Anwendungsdaten\Mozilla\Firefox\Profiles\adv4zyxe.default\extensions\finder@meingutscheincode.de
[2011.04.28 13:04:47 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2008.08.18 23:07:46 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2008.12.30 13:57:56 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2008.12.30 13:57:56 | 000,002,344 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2008.12.30 13:57:56 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2008.12.30 13:57:56 | 000,000,986 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2008.12.30 13:57:56 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

O1 HOSTS File: ([2001.08.23 14:00:00 | 000,000,820 | ---- | M]) - C:\WINXP\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKCU..\Run: [kmQvQcUSBfWiJhv] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\kmQvQcUSBfWiJhv.exe (WinTrust)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Dokumente und Einstellungen\Benni\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm ()
O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra Button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\WINXP\system32\nwprovau.dll (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINXP\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\kbupdate: DllName - kbupdate.dll - File not found
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Benni\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Benni\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O27 - HKLM IFEO\chrome.exe: Debugger - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
O27 - HKLM IFEO\navigator.exe: Debugger - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
O27 - HKLM IFEO\opera.exe: Debugger - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
O27 - HKLM IFEO\safari.exe: Debugger - C:\Programme\Internet Explorer\iexplore.exe (Microsoft Corporation)
O30 - LSA: Authentication Packages - (nwprovau) - C:\WINXP\System32\nwprovau.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.08.18 18:18:03 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011.04.28 14:33:43 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Benni\Recent
[2011.04.28 14:31:02 | 000,580,608 | -H-- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Benni\Desktop\OTL.exe
[2011.04.28 14:15:43 | 000,573,440 | ---- | C] (WinTrust) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\kmQvQcUSBfWiJhv.exe
[2011.04.21 15:33:25 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Benni\Desktop\Charts April 2011
[2011.04.09 13:31:31 | 000,000,000 | ---D | C] -- C:\WINXP\System32\XPSViewer
[2011.04.09 13:31:28 | 000,000,000 | ---D | C] -- C:\Programme\MSBuild
[2011.04.09 13:31:26 | 000,000,000 | ---D | C] -- C:\WINXP\System32\en-US
[2011.04.09 13:31:19 | 000,000,000 | ---D | C] -- C:\Programme\Reference Assemblies
[2011.04.09 13:30:56 | 001,676,288 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\xpssvcs.dll
[2011.04.09 13:30:56 | 001,676,288 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\xpssvcs.dll
[2011.04.09 13:30:56 | 000,597,504 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\printfilterpipelinesvc.exe
[2011.04.09 13:30:56 | 000,575,488 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\xpsshhdr.dll
[2011.04.09 13:30:56 | 000,117,760 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\prntvpt.dll
[2011.04.09 13:30:56 | 000,089,088 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\filterpipelineprintproc.dll
[2011.04.09 13:30:55 | 000,000,000 | ---D | C] -- E:\1f59336d94936141f59b078c6e3d4e53
[2011.04.04 17:51:21 | 000,000,000 | ---D | C] -- E:\SPSSS
[2011.04.04 17:51:20 | 000,000,000 | ---D | C] -- E:\SMRTNTKY
[2011.04.04 17:51:20 | 000,000,000 | ---D | C] -- E:\Scan
[2011.04.04 17:15:24 | 000,000,000 | ---D | C] -- E:\Thesis
[2011.04.04 13:58:52 | 000,000,000 | ---D | C] -- C:\WINXP\xxclone.arc
[2011.04.04 13:58:43 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\XXCLONE
[2011.04.04 13:55:01 | 365,928,624 | -H-- | C] (DATA BECKER GmbH & Co. KG ) -- C:\Dokumente und Einstellungen\Benni\Desktop\s2d7pro_r1_sp2_winload.exe
[2011.04.04 13:52:11 | 000,000,000 | ---D | C] -- C:\xxclone
[2011.04.04 13:48:36 | 000,000,000 | -H-D | C] -- C:\Dokumente und Einstellungen\Benni\Lokale Einstellungen\Anwendungsdaten\Conduit
[2011.04.04 13:48:36 | 000,000,000 | ---D | C] -- C:\Programme\Conduit
[2011.03.31 19:22:05 | 000,000,000 | ---D | C] -- C:\WINXP\System32\KB905474
[2011.03.31 19:18:40 | 000,000,000 | ---D | C] -- C:\WINXP\ie7updates
[2011.03.31 16:19:22 | 000,978,944 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\mfc42.dll
[2011.03.31 16:19:15 | 000,357,888 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\srv.sys
[2011.03.31 16:19:10 | 000,617,472 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\comctl32.dll
[2011.03.31 16:19:09 | 000,455,936 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\mrxsmb.sys
[2011.03.31 16:18:46 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\helpsvc.exe
[2011.03.31 16:18:45 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\ndproxy.sys
[2011.03.31 16:14:41 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\browserchoice.exe
[2011.03.31 16:14:33 | 003,558,912 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\moviemk.exe
[2011.03.31 16:13:39 | 000,000,000 | ---D | C] -- C:\Programme\MSXML 4.0
[2011.03.31 16:12:33 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\netapi32.dll
[2011.03.31 16:11:31 | 001,172,480 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\msxml3.dll
[2011.03.31 16:10:49 | 002,151,424 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\ntkrnlmp.exe
[2011.03.31 16:10:48 | 002,195,072 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\ntoskrnl.exe
[2011.03.31 16:10:48 | 002,071,680 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\ntkrnlpa.exe
[2011.03.31 16:10:48 | 002,029,568 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\ntkrpamp.exe
[2011.03.31 16:10:45 | 000,512,000 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\jscript.dll
[2011.03.31 16:09:58 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\wab.exe
[2011.03.31 16:09:57 | 000,590,848 | ---- | C] (Microsoft Corporation) -- C:\WINXP\System32\dllcache\rpcrt4.dll
[4 C:\WINXP\*.tmp files -> C:\WINXP\*.tmp -> ]
[1 C:\WINXP\System32\*.tmp files -> C:\WINXP\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011.04.28 14:31:03 | 000,580,608 | -H-- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\Benni\Desktop\OTL.exe
[2011.04.28 14:22:00 | 000,000,242 | -H-- | M] () -- C:\WINXP\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2011.04.28 14:15:43 | 000,573,440 | ---- | M] (WinTrust) -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\kmQvQcUSBfWiJhv.exe
[2011.04.28 14:00:00 | 000,000,282 | -H-- | M] () -- C:\WINXP\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
[2011.04.28 12:54:41 | 000,000,256 | ---- | M] () -- C:\WINXP\tasks\WGASetup.job
[2011.04.28 12:52:35 | 000,002,048 | --S- | M] () -- C:\WINXP\bootstat.dat
[2011.04.28 12:52:32 | 2146,750,464 | -HS- | M] () -- C:\hiberfil.sys
[2011.04.27 13:08:12 | 000,000,276 | ---- | M] () -- C:\WINXP\tasks\AppleSoftwareUpdate.job
[2011.04.26 12:55:20 | 000,002,206 | ---- | M] () -- C:\WINXP\System32\wpa.dbl
[2011.04.17 18:46:44 | 001,470,280 | ---- | M] () -- C:\WINXP\System32\FNTCACHE.DAT
[2011.04.17 17:29:22 | 000,001,374 | ---- | M] () -- C:\WINXP\imsins.BAK
[2011.04.17 17:28:43 | 000,448,818 | ---- | M] () -- C:\WINXP\System32\perfh007.dat
[2011.04.17 17:28:43 | 000,432,664 | ---- | M] () -- C:\WINXP\System32\perfh009.dat
[2011.04.17 17:28:43 | 000,080,030 | ---- | M] () -- C:\WINXP\System32\perfc007.dat
[2011.04.17 17:28:43 | 000,067,428 | ---- | M] () -- C:\WINXP\System32\perfc009.dat
[2011.04.13 01:57:46 | 000,010,525 | ---- | M] () -- E:\18042011.pls
[2011.04.13 01:57:46 | 000,008,814 | ---- | M] () -- E:\18042011.m3u
[2011.04.13 01:57:46 | 000,006,711 | ---- | M] () -- E:\18042011.nfo
[2011.04.13 01:57:46 | 000,005,149 | ---- | M] () -- E:\18042011.sfv
[2011.04.12 13:21:01 | 000,000,603 | ---- | M] () -- E:\benni muke.lnk
[2011.04.10 17:31:28 | 899,586,449 | -H-- | M] () -- C:\Dokumente und Einstellungen\Benni\Desktop\TVSII - FT FD.wmv
[2011.04.10 03:33:00 | 000,000,438 | ---- | M] () -- C:\WINXP\tasks\Driver Robot.job
[2011.04.09 13:28:18 | 000,137,656 | ---- | M] (Avira GmbH) -- C:\WINXP\System32\drivers\avipbb.sys
[2011.04.09 13:28:18 | 000,061,960 | ---- | M] (Avira GmbH) -- C:\WINXP\System32\drivers\avgntflt.sys
[2011.04.08 17:15:00 | 000,000,382 | ---- | M] () -- C:\WINXP\tasks\1-Click Maintenance.job
[2011.04.04 18:22:09 | 000,123,904 | -H-- | M] () -- C:\Dokumente und Einstellungen\Benni\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.04.04 14:05:32 | 365,928,624 | -H-- | M] (DATA BECKER GmbH & Co. KG ) -- C:\Dokumente und Einstellungen\Benni\Desktop\s2d7pro_r1_sp2_winload.exe
[4 C:\WINXP\*.tmp files -> C:\WINXP\*.tmp -> ]
[1 C:\WINXP\System32\*.tmp files -> C:\WINXP\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011.04.23 20:19:22 | 899,586,449 | -H-- | C] () -- C:\Dokumente und Einstellungen\Benni\Desktop\TVSII - FT FD.wmv
[2011.04.21 15:32:43 | 000,010,525 | ---- | C] () -- E:\18042011.pls
[2011.04.21 15:32:43 | 000,008,814 | ---- | C] () -- E:\18042011.m3u
[2011.04.21 15:32:43 | 000,006,711 | ---- | C] () -- E:\18042011.nfo
[2011.04.21 15:32:43 | 000,005,149 | ---- | C] () -- E:\18042011.sfv
[2011.04.21 15:32:43 | 000,000,138 | ---- | C] () -- E:\Media Monkey.url
[2011.04.21 15:32:43 | 000,000,108 | ---- | C] () -- E:\CannaPower.url
[2011.03.31 19:22:06 | 000,000,256 | ---- | C] () -- C:\WINXP\tasks\WGASetup.job
[2010.08.08 15:17:28 | 000,027,648 | ---- | C] () -- C:\WINXP\System32\AVSredirect.dll
[2010.05.13 13:34:52 | 000,053,248 | ---- | C] () -- C:\WINXP\System32\mgxasio2.dll
[2010.05.13 13:27:21 | 000,120,200 | ---- | C] () -- C:\WINXP\System32\DLLDEV32i.dll
[2010.05.13 13:26:56 | 000,007,119 | ---- | C] () -- C:\WINXP\mgxoschk.ini
[2010.04.15 16:08:02 | 000,010,831 | ---- | C] () -- C:\WINXP\System32\MpUpMon.dll
[2010.04.15 16:07:44 | 000,001,302 | ---- | C] () -- C:\WINXP\System32\MpEnum.ini
[2010.04.15 16:07:44 | 000,000,026 | ---- | C] () -- C:\WINXP\System32\MpNetIpc.ini
[2010.03.31 18:21:48 | 000,000,020 | ---- | C] () -- C:\WINXP\System32\crt.dat
[2010.03.31 18:21:47 | 000,001,702 | ---- | C] () -- C:\WINXP\System32\kboem32.dat
[2010.03.29 16:46:31 | 000,049,152 | ---- | C] () -- C:\WINXP\System32\AudioEncoderEnum.dll
[2010.02.27 15:52:02 | 000,000,036 | ---- | C] () -- C:\WINXP\rasqervy.dll
[2010.02.27 15:52:02 | 000,000,008 | ---- | C] () -- C:\WINXP\sdfinacs.dll
[2010.02.27 15:51:59 | 000,000,005 | ---- | C] () -- C:\WINXP\sdfixwcs.dll
[2010.02.24 15:58:57 | 027,001,559 | ---- | C] () -- C:\Programme\wave lab 5 + serial.zip
[2010.02.24 15:53:01 | 000,080,946 | ---- | C] () -- C:\WINXP\msacm32.drv
[2010.02.24 15:53:01 | 000,000,104 | ---- | C] () -- C:\WINXP\wuasirvy.dll
[2009.08.11 13:16:49 | 000,000,000 | ---- | C] () -- C:\WINXP\Editor.INI
[2009.07.30 16:43:48 | 000,000,010 | ---- | C] () -- C:\WINXP\WININIT.INI
[2009.07.20 22:54:25 | 000,000,000 | ---- | C] () -- C:\WINXP\ativpsrm.bin
[2009.01.24 21:11:02 | 000,001,877 | ---- | C] () -- C:\WINXP\cdplayer.ini
[2008.08.19 12:23:20 | 000,000,056 | -H-- | C] () -- C:\WINXP\System32\ezsidmv.dat
[2008.08.18 22:55:13 | 000,000,000 | ---- | C] () -- C:\WINXP\nsreg.dat
[2008.08.18 22:53:16 | 000,010,752 | ---- | C] () -- C:\WINXP\System32\BASSMOD.dll
[2008.08.18 22:15:14 | 000,153,088 | ---- | C] () -- C:\WINXP\System32\IWUninstall.exe
[2008.08.18 22:06:19 | 000,123,904 | -H-- | C] () -- C:\Dokumente und Einstellungen\Benni\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.08.18 19:09:51 | 000,004,073 | ---- | C] () -- C:\WINXP\ODBCINST.INI
[2008.08.18 19:08:37 | 001,470,280 | ---- | C] () -- C:\WINXP\System32\FNTCACHE.DAT
[2008.08.18 18:19:06 | 000,002,048 | --S- | C] () -- C:\WINXP\bootstat.dat
[2008.08.18 18:15:04 | 000,021,740 | ---- | C] () -- C:\WINXP\System32\emptyregdb.dat
[2008.07.23 18:50:52 | 003,596,288 | ---- | C] () -- C:\WINXP\System32\qt-dx331.dll
[2008.07.23 18:46:38 | 000,012,288 | ---- | C] () -- C:\WINXP\System32\DivXWMPExtType.dll
[2008.02.07 11:05:18 | 000,163,840 | ---- | C] () -- C:\WINXP\System32\hppatusg01.dll
[2004.08.04 01:12:38 | 000,001,804 | ---- | C] () -- C:\WINXP\System32\dcache.bin
[2004.08.02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINXP\System32\secupd.dat
[2001.08.23 14:00:00 | 013,107,200 | ---- | C] () -- C:\WINXP\System32\oembios.bin
[2001.08.23 14:00:00 | 000,673,088 | ---- | C] () -- C:\WINXP\System32\mlang.dat
[2001.08.23 14:00:00 | 000,448,818 | ---- | C] () -- C:\WINXP\System32\perfh007.dat
[2001.08.23 14:00:00 | 000,432,664 | ---- | C] () -- C:\WINXP\System32\perfh009.dat
[2001.08.23 14:00:00 | 000,272,128 | ---- | C] () -- C:\WINXP\System32\perfi009.dat
[2001.08.23 14:00:00 | 000,269,480 | ---- | C] () -- C:\WINXP\System32\perfi007.dat
[2001.08.23 14:00:00 | 000,218,003 | ---- | C] () -- C:\WINXP\System32\dssec.dat
[2001.08.23 14:00:00 | 000,080,030 | ---- | C] () -- C:\WINXP\System32\perfc007.dat
[2001.08.23 14:00:00 | 000,067,428 | ---- | C] () -- C:\WINXP\System32\perfc009.dat
[2001.08.23 14:00:00 | 000,046,258 | ---- | C] () -- C:\WINXP\System32\mib.bin
[2001.08.23 14:00:00 | 000,034,478 | ---- | C] () -- C:\WINXP\System32\perfd007.dat
[2001.08.23 14:00:00 | 000,028,626 | ---- | C] () -- C:\WINXP\System32\perfd009.dat
[2001.08.23 14:00:00 | 000,004,463 | ---- | C] () -- C:\WINXP\System32\oembios.dat
[2001.08.23 14:00:00 | 000,000,741 | ---- | C] () -- C:\WINXP\System32\noise.dat

< End of report >

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

:OTL
PRC - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\kmQvQcUSBfWiJhv.exe (WinTrust)
O4 - HKCU..\Run: [kmQvQcUSBfWiJhv] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\kmQvQcUSBfWiJhv.exe (WinTrust)
O20 - Winlogon\Notify\kbupdate: DllName - kbupdate.dll - File not found
[2011.04.28 14:22:00 | 000,000,242 | -H-- | M] () -- C:\WINXP\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2011.04.28 14:00:00 | 000,000,282 | -H-- | M] () -- C:\WINXP\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job

:Files
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\kmQvQcUSBfWiJhv.exe

:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
start im normalen modus funktioniert wieder.
lade unhide:
http://www.trojaner-board.de/54791-a...ner-board.html

Der inhalt des Textdokumentes nach dem Neustart ist

All processes killed
========== OTL ==========
No active process named kmQvQcUSBfWiJhv.exe was found!
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\kmQvQcUSBfWiJhv deleted successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\kmQvQcUSBfWiJhv.exe moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\kbupdate\ deleted successfully.
C:\WINXP\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job moved successfully.
C:\WINXP\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job moved successfully.
========== FILES ==========
File\Folder C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\kmQvQcUSBfWiJhv.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Benni
->Flash cache emptied: 1402 bytes

User: Default User

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: All Users

User: Benni
->Temp folder emptied: 60 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 39365627 bytes
->Opera cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 38,00 mb

Error: Unable to interpret <[Reboot]8 14:00:00 | 000,000,282 | -H-- | M] () -- C:\WINXP\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job> in the current context!

OTL by OldTimer - Version 3.2.22.3 log created on 04282011_170209

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

wo ist der upload?

Hallo Markus,

Meinst du, dass ich die rar-Datei uploaden soll?

ja genau das.

Hallo,

im Anhang die Moved Files zip Datei

besten Dank vorab

was steht denn hier wo du sie hochladen sollst? willst du vllt das sich wegen deiner uploads hier jemand infiziert?
gut das die datei von deinem av gelöscht wurde.
bitte erstelle und poste ein combofix log.
Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Hi Markus,

nochmal bezüglich des Trojaners. Ich habe die zip-Datei hochgeladen wie es das Forum vorgibt. Wie geht es weiter? Die Fehlermeldungen erscheinen nicht mehr, allerdings, sind meine Daten nach wie vor nicht sichtbar, obwohl ich das hide-Programm drüberlaufen gelassen habe.

Vielen Dank vorab

Gruß

wo ist das log was ich angefordert hab... ich warte auf deine antwort, die anweisung was zu tun ist steht nem post über deinem