System sehr langsam! TR/Spyeye.FA?

Basti1511 · 29.05.2011, 12:23

Hallo M-K-D-B!

Vielen Dank bis hierher!

Wegen der Kapazität der Festplatte habe ich gerade meine Externe hier liegen um Platz zu schaffen. Kann es passieren, dass ich mir den Trojaner mit auf die externe Platte ziehe?

Hier nun das Logfile von GMER:
GMER Logfile:

Code:

ATTFilter

GMER 1.0.15.15627 - GMER - Rootkit Detector and Remover
Rootkit scan 2011-05-29 13:04:59
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 FUJITSU_MHY2160BH rev.0000000B
Running: gb1q2gp1.exe; Driver: C:\Users\Basti\AppData\Local\Temp\pgloqpow.sys


---- System - GMER 1.0.15 ----

INT 0x01        \SystemRoot\system32\DRIVERS\atikmdag.sys (ATI Radeon Kernel Mode Driver/ATI Technologies Inc.)  8C7F159A
INT 0x03        \SystemRoot\system32\DRIVERS\atikmdag.sys (ATI Radeon Kernel Mode Driver/ATI Technologies Inc.)  8C7F1655

---- Kernel code sections - GMER 1.0.15 ----

.text           C:\Windows\system32\DRIVERS\atikmdag.sys                                                         section is writeable [0x8C609000, 0x1E7C34, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                          Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                          Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000df0477133                      
Reg             HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000df0477133 (not active ControlSet)  

---- EOF - GMER 1.0.15 ----

--- --- ---

Logflife von OTL:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 29.05.2011 13:08:55 - Run 2
OTL by OldTimer - Version 3.2.23.0     Folder = C:\Users\Basti\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 0,89 Gb Available Physical Memory | 44,77% Memory free
4,23 Gb Paging File | 3,04 Gb Available in Paging File | 71,78% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,05 Gb Total Space | 9,84 Gb Free Space | 6,65% Space Free | Partition Type: NTFS
 
Computer Name: BASTI-PC | User Name: Basti | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Basti\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Windows\System32\FsUsbExService.Exe (Teruten)
PRC - C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\Programme\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Firebird\Firebird_2_1\bin\fb_inet_server.exe (Firebird Project)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\Programme\WinTV\EPG Services\System\EPGService.exe (Hauppauge Computer Works)
PRC - C:\Windows\System32\PSIService.exe ()
PRC - C:\Windows\System32\agrsmsvc.exe (Agere Systems)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Basti\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Samsung UPD Service) -- C:\Windows\System32\SUPDSvc.exe (Samsung Electronics CO., LTD.)
SRV - (FsUsbExService) -- C:\Windows\System32\FsUsbExService.Exe (Teruten)
SRV - (TomTomHOMEService) -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (FirebirdServerDefaultInstance) -- C:\Program Files\Firebird\Firebird_2_1\bin\fb_inet_server.exe (Firebird Project)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (HauppaugeTVServer) -- C:\Programme\WinTV\HCWTVServer.exe (Hauppauge Computer Works)
SRV - (EPGService) -- C:\Programme\WinTV\EPG Services\System\EPGService.exe (Hauppauge Computer Works)
SRV - (NishService) -- C:\Programme\LG Software\System Control Manager\edd.exe ()
SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation)
SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation)
SRV - (o2flash) -- C:\Program Files\O2Micro Oz128 Driver\o2flash.exe (O2Micro International)
SRV - (ProtexisLicensing) -- C:\Windows\System32\PSIService.exe ()
SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (speedfan) -- C:\Windows\system32\speedfan.sys (Almico Software)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (FsUsbExDisk) -- C:\Windows\System32\FsUsbExDisk.Sys ()
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (s0016unic) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM) -- C:\Windows\System32\drivers\s0016unic.sys (MCCI Corporation)
DRV - (s0016nd5) Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS) -- C:\Windows\System32\drivers\s0016nd5.sys (MCCI Corporation)
DRV - (s0016mdfl) -- C:\Windows\System32\drivers\s0016mdfl.sys (MCCI Corporation)
DRV - (s0016mdm) -- C:\Windows\System32\drivers\s0016mdm.sys (MCCI Corporation)
DRV - (s0016mgmt) Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM) -- C:\Windows\System32\drivers\s0016mgmt.sys (MCCI Corporation)
DRV - (s0016obex) -- C:\Windows\System32\drivers\s0016obex.sys (MCCI Corporation)
DRV - (s0016bus) Sony Ericsson Device 0016 driver (WDM) -- C:\Windows\System32\drivers\s0016bus.sys (MCCI Corporation)
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation                                            )
DRV - (hcw95rc) -- C:\Windows\System32\drivers\hcw95rc.sys (Hauppauge Computer Works, Inc.)
DRV - (hcw95bda) -- C:\Windows\System32\drivers\hcw95bda.sys (Hauppauge Computer Works, Inc.)
DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
DRV - (O2MDRDR) -- C:\Windows\system32\DRIVERS\o2media.sys (O2Micro )
DRV - (O2SDRDR) -- C:\Windows\system32\DRIVERS\o2sd.sys (O2Micro )
DRV - (MGHwCtrl) -- C:\Windows\System32\drivers\MGHwCtrl.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
DRV - (MTOnlPktAlyX) -- C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyx.sys (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
DRV - (giveio) -- C:\Windows\system32\giveio.sys ()
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.lge.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=gppc&s={searchTerms}&f=4
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Facemoods Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 2
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: {ED0CF0C8-62F1-4865-A3FD-2E2A2B50FAFA}:1.0
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
 
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{ED0CF0C8-62F1-4865-A3FD-2E2A2B50FAFA}: C:\Users\Basti\AppData\Roaming\5008 [2010.11.16 13:06:13 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.04.30 15:37:42 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.04.06 12:37:03 | 000,000,000 | ---D | M]
 
[2009.12.25 16:22:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Basti\AppData\Roaming\mozilla\Extensions
[2009.12.25 16:22:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Basti\AppData\Roaming\mozilla\Extensions\home2@tomtom.com
[2011.05.26 20:29:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Basti\AppData\Roaming\mozilla\Firefox\Profiles\0n1gga6f.default\extensions
[2009.06.26 16:29:58 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Basti\AppData\Roaming\mozilla\Firefox\Profiles\0n1gga6f.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009.05.10 20:11:08 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\Basti\AppData\Roaming\mozilla\Firefox\Profiles\0n1gga6f.default\extensions\moveplayer@movenetworks.com
[2011.05.12 10:07:38 | 000,000,950 | ---- | M] () -- C:\Users\Basti\AppData\Roaming\Mozilla\Firefox\Profiles\0n1gga6f.default\searchplugins\icqplugin-1.xml
[2008.07.13 22:18:48 | 000,000,950 | ---- | M] () -- C:\Users\Basti\AppData\Roaming\Mozilla\Firefox\Profiles\0n1gga6f.default\searchplugins\icqplugin.xml
[2011.05.29 02:20:40 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2008.07.03 10:08:56 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.04.06 12:37:10 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
File not found (No name found) -- 
[2008.06.06 21:38:30 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
[2008.10.12 21:56:14 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
[2011.04.06 12:37:10 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010.11.16 13:06:13 | 000,000,000 | ---D | M] (Java String Helper) -- C:\USERS\BASTI\APPDATA\ROAMING\5008
[2011.04.30 15:37:39 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll
[2011.04.06 12:36:37 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2011.05.26 20:24:52 | 000,002,047 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\fcmdSrch.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Programme\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKCU\..\Toolbar\WebBrowser: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Programme\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4 - HKLM..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4 - HKLM..\Run: [IJNetworkScanUtility] C:\Programme\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe (CANON INC.)
O4 - HKLM..\Run: [NPSStartup]  File not found
O4 - HKCU..\Run: [Winjava] C:\Users\Basti\AppData\Roaming\Catpack\crtpack.exe ()
O4 - HKCU..\Run: [WMPNSCFG] C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -  File not found
O9 - Extra 'Tools' menuitem : ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} -  File not found
O13 - gopher Prefix: missing
O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} hxxp://static.pe.studivz.net/photouploader/ImageUploader5.cab?nocache=1223841640 (Image Uploader Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Basti\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\Basti\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{6729c6b9-e854-11dc-b742-806e6f6e6963}\Shell\AutoRun\command - "" = D:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe
O33 - MountPoints2\{9d40478d-f15f-11de-b255-001d924e3928}\Shell\AutoRun\command - "" = D:\InstallTomTomHOME.exe
O33 - MountPoints2\D\Shell\AutoRun\command - "" = D:\wdsync.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.3
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.3
ActiveX: {2A3320D6-C805-4280-B423-B665BDE33D8F} - Microsoft .NET Framework 1.1 Security Update (KB979906)
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E78BFA60-5393-4C38-82AB-E8019E464EB4} - .NET Framework
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpFolder: C:^Users^Basti^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^meine software.lnk - C:\Programme\T-Home\Meine Software\meine software.exe - (Deutsche Telekom AG)
MsConfig - StartUpReg: Adobe Reader Speed Launcher - hkey= - key= - C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
MsConfig - StartUpReg: AutoStartNPSAgent - hkey= - key= - C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
MsConfig - StartUpReg: ContentTransferWMDetector.exe - hkey= - key= - C:\Programme\Sony\Content Transfer\ContentTransferWMDetector.exe (Sony Corporation)
MsConfig - StartUpReg: ehTray.exe - hkey= - key= - C:\Windows\ehome\ehtray.exe (Microsoft Corporation)
MsConfig - StartUpReg: EPGServiceTool - hkey= - key= - C:\Programme\WinTV\EPG Services\System\EPGClient.exe (Hauppauge Inc.)
MsConfig - StartUpReg: EPSON Stylus DX4800 Series - hkey= - key= -  File not found
MsConfig - StartUpReg: ICQ - hkey= - key= -  File not found
MsConfig - StartUpReg: IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - hkey= - key= - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG)
MsConfig - StartUpReg: JREcSGVrdPtfUH.exe - hkey= - key= -  File not found
MsConfig - StartUpReg: LG Intelligent Update - hkey= - key= - C:\Program Files\lg_swupdate\giljabistart.exe (BIT LEADER)
MsConfig - StartUpReg: MGSysCtrl - hkey= - key= - C:\Programme\LG Software\System Control Manager\MGSysCtrl.exe (MSI)
MsConfig - StartUpReg: NBKeyScan - hkey= - key= - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
MsConfig - StartUpReg: RacA_isv - hkey= - key= -  File not found
MsConfig - StartUpReg: Rainlendar2 - hkey= - key= - C:\Programme\Rainlendar2\Rainlendar2.exe ()
MsConfig - StartUpReg: RtHDVCpl - hkey= - key= - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
MsConfig - StartUpReg: SearchSettings - hkey= - key= -  File not found
MsConfig - StartUpReg: Skytel - hkey= - key= - C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
MsConfig - StartUpReg: StartCCC - hkey= - key= - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe ()
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig - StartUpReg: TkBellExe - hkey= - key= - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
MsConfig - StartUpReg: TomTomHOME.exe - hkey= - key= - C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
MsConfig - StartUpReg: Windows Defender - hkey= - key= -  File not found
MsConfig - StartUpReg: Windows Mobile Device Center - hkey= - key= - C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)
MsConfig - StartUpReg: WMPNSCFG - hkey= - key= - C:\Programme\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
MsConfig - StartUpReg: yJFzBVUcTw - hkey= - key= -  File not found
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 2
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.05.29 02:55:35 | 000,100,736 | ---- | C] (GMER) -- C:\pgloqpow.sys
[2011.05.29 02:53:22 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011.05.29 02:52:40 | 000,000,000 | ---D | C] -- C:\Programme\ERUNT
[2011.05.29 02:52:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2011.05.29 02:51:25 | 000,791,393 | ---- | C] (Lars Hederer                                                ) -- C:\Users\Basti\Desktop\erunt-setup.exe
[2011.05.26 20:30:31 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Users\Basti\Desktop\OTL.exe
[2011.05.11 10:26:00 | 000,000,000 | ---D | C] -- C:\Users\Basti\AppData\Roaming\Catpack
[2011.05.10 12:18:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.5
[2011.05.10 12:17:19 | 000,000,000 | ---D | C] -- C:\Programme\ICQ7.5
[2011.05.09 20:08:07 | 000,000,000 | ---D | C] -- C:\Programme\SpeedFan
[2011.05.08 19:51:06 | 000,000,000 | ---D | C] -- C:\Users\Basti\Desktop\Neuer Ordner
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Users\Basti\AppData\Roaming\*.tmp files -> C:\Users\Basti\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.05.29 12:48:46 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.05.29 12:48:46 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.05.29 12:05:30 | 000,000,418 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{A6372E64-0662-44BF-826E-B27DF45A00DB}.job
[2011.05.29 10:56:27 | 000,302,080 | ---- | M] () -- C:\Users\Basti\Desktop\gb1q2gp1.exe
[2011.05.29 10:48:42 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.05.29 10:48:39 | 2146,820,096 | -HS- | M] () -- C:\hiberfil.sys
[2011.05.29 03:11:43 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011.05.29 02:55:35 | 000,100,736 | ---- | M] (GMER) -- C:\pgloqpow.sys
[2011.05.29 02:51:26 | 000,791,393 | ---- | M] (Lars Hederer                                                ) -- C:\Users\Basti\Desktop\erunt-setup.exe
[2011.05.28 09:37:06 | 000,679,420 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.05.28 09:37:06 | 000,638,542 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.05.28 09:37:06 | 000,148,576 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.05.28 09:37:06 | 000,121,908 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.05.27 15:19:45 | 000,107,008 | ---- | M] () -- C:\Users\Basti\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.05.26 20:30:33 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\Basti\Desktop\OTL.exe
[2011.05.09 20:08:08 | 000,000,804 | ---- | M] () -- C:\Users\Basti\Desktop\SpeedFan.lnk
[2011.05.09 20:08:07 | 000,000,045 | ---- | M] () -- C:\Windows\System32\initdebug.nfo
[2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Users\Basti\AppData\Roaming\*.tmp files -> C:\Users\Basti\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.05.29 10:56:26 | 000,302,080 | ---- | C] () -- C:\Users\Basti\Desktop\gb1q2gp1.exe
[2011.05.16 16:17:15 | 2146,820,096 | -HS- | C] () -- C:\hiberfil.sys
[2011.05.09 20:08:08 | 000,000,804 | ---- | C] () -- C:\Users\Basti\Desktop\SpeedFan.lnk
[2011.05.09 20:07:18 | 000,000,045 | ---- | C] () -- C:\Windows\System32\initdebug.nfo
[2011.03.15 23:06:00 | 000,000,000 | ---- | C] () -- C:\Users\Basti\AppData\Local\Tempmkwa.$$$
[2010.11.17 19:59:33 | 000,000,035 | ---- | C] () -- C:\Users\Basti\AppData\Roaming\urhtps.dat
[2010.04.23 11:03:29 | 000,482,408 | ---- | C] () -- C:\Windows\ssndii.exe
[2010.04.23 11:00:52 | 000,260,464 | ---- | C] () -- C:\Windows\SUPDRun.exe
[2010.04.23 11:00:49 | 000,282,624 | ---- | C] () -- C:\Windows\System32\DscPnt.dll
[2010.04.23 11:00:49 | 000,026,624 | ---- | C] () -- C:\Windows\System32\spd__l.dll
[2010.04.03 12:35:13 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll
[2010.04.03 12:35:13 | 000,036,608 | ---- | C] () -- C:\Windows\System32\FsUsbExDisk.Sys
[2009.10.28 13:24:52 | 000,000,093 | ---- | C] () -- C:\Users\Basti\AppData\Local\fusioncache.dat
[2009.09.17 16:14:16 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.09.17 16:14:15 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.03.06 00:50:08 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2009.02.02 20:10:14 | 000,303,104 | ---- | C] () -- C:\Windows\System32\dnt27VC8.dll
[2009.02.02 20:08:36 | 000,090,112 | ---- | C] () -- C:\Windows\System32\dntvmc27VC8.dll
[2009.02.02 20:08:22 | 000,086,016 | ---- | C] () -- C:\Windows\System32\dntvm27VC8.dll
[2008.11.03 17:52:04 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.09.19 23:57:34 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2008.09.19 23:54:18 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll
[2008.09.08 17:05:58 | 000,000,399 | ---- | C] () -- C:\Windows\vtplus32.ini
[2008.09.08 17:05:55 | 000,000,030 | ---- | C] () -- C:\Windows\System32\UNWISE.INI
[2008.09.08 17:05:53 | 000,149,504 | ---- | C] () -- C:\Windows\System32\UNWISE.EXE
[2008.09.08 17:05:21 | 000,032,133 | ---- | C] () -- C:\Windows\Irremote.ini
[2008.09.08 17:00:52 | 000,065,536 | ---- | C] () -- C:\Windows\System32\dmcrypto.dll
[2008.09.08 17:00:20 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2008.09.08 17:00:18 | 000,159,744 | ---- | C] () -- C:\Windows\System32\hcwChDB.dll
[2008.09.08 16:59:06 | 000,006,241 | ---- | C] () -- C:\Windows\HCWPNP.INI
[2008.04.27 12:08:49 | 000,000,592 | ---- | C] () -- C:\Windows\RDOFFICE.INI
[2008.03.01 21:48:34 | 000,000,510 | ---- | C] () -- C:\Windows\ODBC.INI
[2008.02.08 11:15:18 | 000,000,032 | ---- | C] () -- C:\ProgramData\ezsid.dat
[2008.02.07 12:38:16 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2008.02.07 12:14:56 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2008.02.07 12:12:22 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html
[2008.02.01 00:38:55 | 000,107,008 | ---- | C] () -- C:\Users\Basti\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.01.31 22:40:51 | 000,000,952 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys
[2008.01.18 21:31:55 | 000,045,056 | ---- | C] () -- C:\Windows\UncompAVIToWMV2.exe
[2007.11.19 08:42:49 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2007.11.19 08:35:50 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007.11.19 08:30:41 | 003,107,788 | ---- | C] () -- C:\Windows\System32\atiumdva.dat
[2007.11.19 08:30:41 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2007.11.19 08:09:22 | 000,110,592 | ---- | C] () -- C:\Windows\System32\MGHwCtrl.dll
[2007.11.19 08:09:22 | 000,032,768 | ---- | C] () -- C:\Windows\System32\MGFPCtrl.dll
[2007.11.19 08:09:22 | 000,024,576 | ---- | C] () -- C:\Windows\System32\MGPwrShm.dll
[2007.11.19 08:08:46 | 000,008,117 | ---- | C] () -- C:\Windows\lg_up.ini
[2007.11.19 08:07:50 | 000,001,010 | ---- | C] () -- C:\Windows\lgcenter.ini
[2007.11.19 08:07:30 | 000,000,213 | ---- | C] () -- C:\Windows\lgps.ini
[2007.11.19 08:02:46 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2007.11.08 17:54:34 | 000,159,146 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2007.10.25 17:26:10 | 000,005,632 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2007.08.29 16:55:38 | 000,081,920 | ---- | C] () -- C:\Windows\System32\sw2_ttls_manager.exe
[2006.11.02 21:40:12 | 000,174,656 | ---- | C] () -- C:\Windows\System32\PSIService.exe
[2006.11.02 17:33:31 | 000,679,420 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,148,576 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,259,192 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,638,542 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,121,908 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[1999.01.22 20:46:58 | 000,065,536 | ---- | C] () -- C:\Windows\System32\MSRTEDIT.DLL
[1996.04.03 21:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys
 
========== LOP Check ==========
 
[2010.11.16 13:06:13 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\5008
[2010.03.13 12:11:48 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\Buhl Data Service
[2010.03.24 18:35:51 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\Buhl Data Service GmbH
[2011.05.19 21:20:30 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\Catpack
[2010.11.16 11:16:51 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\cock
[2009.08.09 15:38:13 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\Engelmann Media
[2010.08.05 08:14:37 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\Eposez
[2008.10.22 20:21:28 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\EPSON
[2011.05.29 02:48:41 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\ICQ
[2008.02.07 12:18:01 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\ICQLite
[2010.08.05 15:34:41 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\Igodf
[2010.05.14 10:01:10 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\Lexware
[2009.06.04 11:05:42 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\NCH Swift Sound
[2010.04.03 12:35:02 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\Samsung
[2009.10.28 13:17:45 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\T-Online
[2009.09.11 20:10:34 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\TeamViewer
[2009.12.25 16:22:35 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\TomTom
[2010.11.23 23:22:36 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\UAs
[2011.01.21 12:34:48 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\xmldm
[2011.05.29 03:11:49 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2011.05.29 12:05:30 | 000,000,418 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{A6372E64-0662-44BF-826E-B27DF45A00DB}.job
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.04.21 11:14:45 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2010.02.08 21:32:06 | 000,000,000 | -HSD | M] -- C:\Boot
[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2008.01.31 21:58:33 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2009.05.27 15:03:55 | 000,000,000 | ---D | M] -- C:\My Downloads
[2008.09.10 21:17:33 | 000,000,000 | ---D | M] -- C:\MyVideos
[2008.10.29 21:02:44 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.05.29 02:52:40 | 000,000,000 | R--D | M] -- C:\Programme
[2011.04.06 12:38:32 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2008.01.31 21:58:33 | 000,000,000 | -HSD | M] -- C:\Programme
[2010.04.23 11:00:40 | 000,000,000 | ---D | M] -- C:\SamsungUniversalPrintDriver
[2011.05.29 13:10:31 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2008.11.21 16:03:00 | 000,000,000 | ---D | M] -- C:\Temp
[2008.03.21 14:01:57 | 000,000,000 | ---D | M] -- C:\THE_GIRL_NEXT_DOOR_UNRATED
[2008.01.31 21:59:17 | 000,000,000 | R--D | M] -- C:\Users
[2011.05.29 02:53:22 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %PROGRAMFILES%\*. >
[2009.11.17 13:49:42 | 000,000,000 | ---D | M] -- C:\Programme\Activision
[2009.05.11 09:50:39 | 000,000,000 | ---D | M] -- C:\Programme\Adobe
[2008.11.21 16:06:04 | 000,000,000 | ---D | M] -- C:\Programme\Ahead
[2009.12.09 17:10:08 | 000,000,000 | ---D | M] -- C:\Programme\Apple Software Update
[2007.11.19 08:19:04 | 000,000,000 | ---D | M] -- C:\Programme\Atheros
[2007.11.19 08:36:09 | 000,000,000 | ---D | M] -- C:\Programme\ATI
[2007.11.19 08:37:16 | 000,000,000 | ---D | M] -- C:\Programme\ATI Technologies
[2008.11.10 22:01:12 | 000,000,000 | ---D | M] -- C:\Programme\Avanquest update
[2009.06.24 17:30:53 | 000,000,000 | ---D | M] -- C:\Programme\Avira
[2009.11.18 23:17:37 | 000,000,000 | ---D | M] -- C:\Programme\Basement Softworks
[2008.02.10 22:57:26 | 000,000,000 | ---D | M] -- C:\Programme\Brockhaus Multimedia
[2010.11.20 23:02:39 | 000,000,000 | ---D | M] -- C:\Programme\Canon
[2010.11.20 22:47:42 | 000,000,000 | -H-D | M] -- C:\Programme\CanonBJ
[2010.12.29 10:31:23 | 000,000,000 | ---D | M] -- C:\Programme\Common Files
[2011.01.15 18:46:06 | 000,000,000 | ---D | M] -- C:\Programme\Convar
[2009.10.28 13:17:58 | 000,000,000 | ---D | M] -- C:\Programme\Deutsche Telekom
[2008.12.02 11:33:44 | 000,000,000 | ---D | M] -- C:\Programme\DivX
[2008.03.01 21:56:36 | 000,000,000 | ---D | M] -- C:\Programme\DVD Shrink DE
[2009.09.11 20:19:00 | 000,000,000 | ---D | M] -- C:\Programme\EDPnet
[2008.09.29 10:40:02 | 000,000,000 | ---D | M] -- C:\Programme\EPSON
[2011.05.29 02:53:02 | 000,000,000 | ---D | M] -- C:\Programme\ERUNT
[2008.02.24 15:25:22 | 000,000,000 | ---D | M] -- C:\Programme\EzManual
[2009.03.23 15:23:34 | 000,000,000 | ---D | M] -- C:\Programme\fc-prints
[2009.09.11 19:34:34 | 000,000,000 | ---D | M] -- C:\Programme\Firebird
[2008.01.31 21:58:33 | 000,000,000 | -HSD | M] -- C:\Programme\Gemeinsame Dateien
[2010.12.01 12:41:02 | 000,000,000 | ---D | M] -- C:\Programme\Google
[2008.04.27 19:48:57 | 000,000,000 | ---D | M] -- C:\Programme\Heirue-Soft
[2009.03.24 16:24:05 | 000,000,000 | ---D | M] -- C:\Programme\ICQ6
[2008.07.03 10:07:00 | 000,000,000 | ---D | M] -- C:\Programme\ICQ6Toolbar
[2011.05.10 12:18:50 | 000,000,000 | ---D | M] -- C:\Programme\ICQ7.5
[2011.05.10 12:17:55 | 000,000,000 | -H-D | M] -- C:\Programme\InstallShield Installation Information
[2010.02.08 21:23:36 | 000,000,000 | ---D | M] -- C:\Programme\Internet Explorer
[2008.12.03 14:38:03 | 000,000,000 | ---D | M] -- C:\Programme\Ipswitch
[2011.04.06 12:36:14 | 000,000,000 | ---D | M] -- C:\Programme\Java
[2010.12.01 14:05:53 | 000,000,000 | ---D | M] -- C:\Programme\lexware
[2008.01.18 21:32:48 | 000,000,000 | ---D | M] -- C:\Programme\LG Software
[2009.11.27 17:53:19 | 000,000,000 | ---D | M] -- C:\Programme\lg_swupdate
[2011.02.19 17:33:35 | 000,000,000 | ---D | M] -- C:\Programme\Malwarebytes' Anti-Malware
[2010.04.03 12:30:44 | 000,000,000 | ---D | M] -- C:\Programme\MarkAny
[2008.03.01 21:46:38 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft FrontPage
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Games
[2010.02.08 21:45:03 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Office
[2008.03.01 21:47:24 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft Visual Studio
[2010.06.28 12:10:25 | 000,000,000 | ---D | M] -- C:\Programme\Microsoft.NET
[2010.08.15 12:13:22 | 000,000,000 | ---D | M] -- C:\Programme\Movie Maker
[2011.05.26 20:24:52 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Programme\MSBuild
[2010.02.08 21:44:01 | 000,000,000 | ---D | M] -- C:\Programme\MSECache
[2009.06.11 20:02:56 | 000,000,000 | ---D | M] -- C:\Programme\MSXML 4.0
[2008.02.24 14:40:32 | 000,000,000 | ---D | M] -- C:\Programme\NCH Swift Sound
[2009.06.10 14:24:27 | 000,000,000 | ---D | M] -- C:\Programme\Nero
[2009.06.10 14:31:52 | 000,000,000 | ---D | M] -- C:\Programme\NeroInstall.bak
[2007.11.19 08:15:30 | 000,000,000 | ---D | M] -- C:\Programme\O2Micro Oz128 Driver
[2009.03.06 00:50:56 | 000,000,000 | ---D | M] -- C:\Programme\PDFCreator
[2009.04.22 20:09:06 | 000,000,000 | ---D | M] -- C:\Programme\photoshop
[2009.09.11 20:10:36 | 000,000,000 | ---D | M] -- C:\Programme\QS
[2009.12.09 17:14:39 | 000,000,000 | ---D | M] -- C:\Programme\QuickTime
[2008.03.29 11:49:20 | 000,000,000 | ---D | M] -- C:\Programme\Rainlendar2
[2008.05.25 14:35:39 | 000,000,000 | ---D | M] -- C:\Programme\RD-Office
[2008.03.31 21:16:02 | 000,000,000 | ---D | M] -- C:\Programme\Real
[2007.11.19 08:39:08 | 000,000,000 | ---D | M] -- C:\Programme\Realtek
[2006.11.02 14:37:34 | 000,000,000 | ---D | M] -- C:\Programme\Reference Assemblies
[2008.07.25 15:20:34 | 000,000,000 | ---D | M] -- C:\Programme\ResusSim Prehospital
[2009.10.14 17:27:56 | 000,000,000 | ---D | M] -- C:\Programme\Rockstar Games
[2010.04.23 11:00:41 | 000,000,000 | ---D | M] -- C:\Programme\Samsung
[2008.02.07 11:57:16 | 000,000,000 | ---D | M] -- C:\Programme\SecureW2
[2008.06.24 11:16:47 | 000,000,000 | ---D | M] -- C:\Programme\sixteen tons entertainment
[2008.02.07 12:21:31 | 000,000,000 | ---D | M] -- C:\Programme\Skype
[2010.12.29 10:31:19 | 000,000,000 | ---D | M] -- C:\Programme\Sony
[2008.11.10 21:45:43 | 000,000,000 | ---D | M] -- C:\Programme\Sony Ericsson
[2011.05.28 10:22:31 | 000,000,000 | ---D | M] -- C:\Programme\SpeedFan
[2008.10.12 21:56:35 | 000,000,000 | ---D | M] -- C:\Programme\Sun
[2008.01.18 21:33:51 | 000,000,000 | ---D | M] -- C:\Programme\Synaptics
[2009.10.28 13:11:25 | 000,000,000 | ---D | M] -- C:\Programme\T-Home
[2009.10.28 13:15:50 | 000,000,000 | ---D | M] -- C:\Programme\T-Online
[2009.12.25 16:22:20 | 000,000,000 | ---D | M] -- C:\Programme\TomTom HOME 2
[2009.12.25 16:22:30 | 000,000,000 | ---D | M] -- C:\Programme\TomTom International B.V
[2006.11.02 15:01:55 | 000,000,000 | -H-D | M] -- C:\Programme\Uninstall Information
[2011.04.06 16:15:14 | 000,000,000 | ---D | M] -- C:\Programme\VideoLAN
[2008.09.08 17:05:58 | 000,000,000 | ---D | M] -- C:\Programme\vtplus
[2008.11.15 19:17:35 | 000,000,000 | ---D | M] -- C:\Programme\Western Digital
[2010.02.08 21:23:39 | 000,000,000 | ---D | M] -- C:\Programme\Windows Calendar
[2010.02.08 21:23:34 | 000,000,000 | ---D | M] -- C:\Programme\Windows Collaboration
[2010.02.08 21:23:25 | 000,000,000 | ---D | M] -- C:\Programme\Windows Defender
[2010.02.08 21:23:34 | 000,000,000 | ---D | M] -- C:\Programme\Windows Journal
[2011.05.11 11:06:35 | 000,000,000 | ---D | M] -- C:\Programme\Windows Mail
[2010.10.14 14:33:21 | 000,000,000 | ---D | M] -- C:\Programme\Windows Media Player
[2010.04.02 20:39:49 | 000,000,000 | ---D | M] -- C:\Programme\Windows Mobile Device Handbook
[2008.01.31 21:58:33 | 000,000,000 | ---D | M] -- C:\Programme\Windows NT
[2010.02.08 21:23:32 | 000,000,000 | ---D | M] -- C:\Programme\Windows Photo Gallery
[2010.02.10 11:57:09 | 000,000,000 | ---D | M] -- C:\Programme\Windows Portable Devices
[2010.12.29 10:31:23 | 000,000,000 | ---D | M] -- C:\Programme\Windows Sidebar
[2008.09.07 21:28:27 | 000,000,000 | ---D | M] -- C:\Programme\WinRAR
[2009.06.28 12:55:37 | 000,000,000 | ---D | M] -- C:\Programme\WinTV
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2007.11.19 13:22:34 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2007.11.19 13:22:33 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008.01.19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe
[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe
[2006.11.02 11:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_f1f7f368deed95c3\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-27 12:51:28

< End of report >

--- --- ---

M-K-D-B · 29.05.2011, 14:36

Hallo Basti1511,

Schritt # 1: Fragen beantworten

Zitat:

Zitat von Basti1511

Wegen der Kapazität der Festplatte habe ich gerade meine Externe hier liegen um Platz zu schaffen. Kann es passieren, dass ich mir den Trojaner mit auf die externe Platte ziehe?

Theoretisch ja, daher warten wir damit bis nach der Bereinigung.

Bitte beantworte mir folgende Fragen:

Hast du die pdfforge Toolbar von deinem Rechner deinstalliert? Im neuen OTL-Logfile siehts zumindest nicht danach aus. Wenn noch nicht getan, deinstalliere bitte die o.g. Toolbar über die Systemsteuerung, bevor du mit dem nächsten Schritt weitermachst.

Schritt # 2: Add-ons in Firefox entfernen

Starte Firefox
Klicke auf Firefox -> Addons -> Erweiterungen
Entferne die folgenden Add-ons (sofern sie vorhanden sind):
- pdfforge Toolbar Plugin
- Search Settings Plugin
Zum Abschluss musst du Firefox schließen und neu starten, damit die Entfernung abgeschlossen werden kann.
Kontrolliere, ob die genannten Erweiterungen auch entfernt wurden.
Schließe Firefox wieder.

Schritt # 3: Fix mit OTL

Starte bitte die OTL.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die Textbox.

Code:

ATTFilter

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://start.facemoods.com/?a=gppc&s={searchTerms}&f=4
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.facemoods.com/?a=gppc
FF - prefs.js..extensions.enabledItems: {ED0CF0C8-62F1-4865-A3FD-2E2A2B50FAFA}:1.0
FF - HKLM\software\mozilla\Firefox\Extensions\\{ED0CF0C8-62F1-4865-A3FD-2E2A2B50FAFA}: C:\Users\Basti\AppData\Roaming\5008 [2010.11.16 13:06:13 | 000,000,000 | ---D | M]
[2009.03.06 00:50:33 | 000,000,000 | ---D | M] (pdfforge Toolbar Plugin) -- C:\Programme\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}
[2009.03.06 00:50:35 | 000,000,000 | ---D | M] (Search Settings Plugin) -- C:\Programme\Mozilla Firefox\extensions\search@searchsettings.com
[2010.11.16 13:06:13 | 000,000,000 | ---D | M] (Java String Helper) -- C:\USERS\BASTI\APPDATA\ROAMING\5008
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\WidgiToolbarIE.dll (GreenTree Applications, Inc.)
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Programme\pdfforge Toolbar\WidgiToolbarIE.dll (GreenTree Applications, Inc.)
O4 - HKLM..\Run: [NPSStartup] File not found
O4 - HKCU..\Run: [Winjava] C:\Users\Basti\AppData\Roaming\Catpack\crtpack.exe ()
MsConfig - StartUpReg: SearchSettings - hkey= - key= -  File not found
MsConfig - StartUpReg: yJFzBVUcTw - hkey= - key= -  File not found
[2011.05.11 10:26:00 | 000,000,000 | ---D | C] -- C:\Users\Basti\AppData\Roaming\Catpack
[2010.11.16 11:16:51 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\cock
[2011.01.21 12:34:48 | 000,000,000 | ---D | M] -- C:\Users\Basti\AppData\Roaming\xmldm

:files
C:\Programme\pdfforge Toolbar
C:\program files\bearshare pro
C:\program files\bearshare
C:\Users\Basti\AppData\Roaming\Catpack

:reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{7FA96573-3EC1-45D5-9AED-6F1B18EE189C}" =-
"{F89FB5FE-C071-4791-BCF1-529B96F28B63}" =-
"TCP Query User{3DA0A7ED-E665-42C8-9675-511F37741BAB}C:\program files\bearshare\bearshare.exe" =-
"TCP Query User{521E81E1-F901-454F-9614-A69D2196A11F}C:\program files\bearshare pro\bearshare.exe" =-
"UDP Query User{B5EEE2FB-A849-4CF9-A453-8AB7C824DE2D}C:\program files\bearshare\bearshare.exe" =-
"UDP Query User{F79428AB-7790-4F98-B2FA-6E66E3255C6B}C:\program files\bearshare pro\bearshare.exe" =-

:Commands
[purity]
[emptytemp]

Schließe bitte nun alle Programme.
Klicke nun bitte auf den Fix Button.
OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
( Auch zu finden unter C:\_OTL\MovedFiles\<time_date>.txt)
Kopiere nun den Inhalt hier in Deinen Thread

Schritt # 4: ComboFix ausführen

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Lade ComboFix von einem dieser Download-Spiegel herunter:

BleepingComputer - ForoSpyware

* Wichtig !! Speichere ComboFix auf dem Desktop

Deaktivere Deine Anti-Virus- und Anti-Spyware-Programme. Normalerweise kannst Du dies über einen Rechtsklick auf das Systemtray-Icon tun. Die Programme könnten sonst eventuell unsere Programme bei deren Arbeit stören.
Doppelklicke auf die ComboFix.exe und folge den Anweisungen.
ComboFix wird schauen, ob die Microsoft-Windows-Wiederherstellungskonsole installiert ist. Dies ist Teil des Prozesses. Angesichts der Art von Malware Infizierungen, die es heute gibt, wird dringend empfohlen, diese Wiederherstellungskonsole auf dem PC installiert zu haben, bevor jegliche Reinigung von Malware durchgeführt wird.
Folge den Anweisungen, um ComboFix das Herunterladen und Installieren der Wiederherstellungskonsole zu ermöglichen und stimme dem Lizenzvertrag (EULA) zu, sobald Du dazu aufgefordert wirst.

**Zur Information: Sollte die Wiederherstellungskonsole schon installiert sein, so wird ComboFix seine Malware-Entfernungsprozedur normal fortfahren.

Sobald die Wiederherstellungskonsole durch ComboFix installiert wurde, solltest Du folgende Nachricht sehen:

Klicke "Ja", um mit dem Suchlauf nach Malware fortzufahren.

Wenn ComboFix fertig ist, wird es ein Log erstellen. Bitte füge die C:\ComboFix.txt Deiner nächsten Antwort bei.

Schritt # 5: Systemscan mit OTL

Starte bitte OTL.exe.
Wähle unter Extra Registrierung: Benutze Safe List und klicke auf den Scan Button.
Poste die OTL.txt und die Extras.txt hier in deinen Thread.

Schritt # 6: Deine Rückmeldung
Zur weiteren Analyse benötige ich zusammen mit deiner nächsten Antwort

die Beantwortung der gestellten Fragen,
eine Rückmeldung bezüglich der zu entfernenden Firefox-Erweiterungen,
das Logfile des OTL-Fix,
das Logfile von ComboFix und
die beiden neuen Logfiles von OTL (OTL.txt und Extras.txt).

System sehr langsam! TR/Spyeye.FA?

Plagegeister aller Art und deren Bekämpfung: System sehr langsam! TR/Spyeye.FA?

System sehr langsam! TR/Spyeye.FA?

System sehr langsam! TR/Spyeye.FA?

Ähnliche Themen: System sehr langsam! TR/Spyeye.FA?