Trojaner-Board - Cpu gesperrt durch Verletzung der Gesetze der BRD

Ausgeführt. Hier ist das Logfile:

Code:

All processes killed

========== OTL ==========

========== FILES ==========

c:\users\Sven\AppData\Roaming\13001.020\components folder moved successfully.

c:\users\Sven\AppData\Roaming\13001.020 folder moved successfully.

c:\users\Sven\AppData\Roaming\13001.021\components folder moved successfully.

c:\users\Sven\AppData\Roaming\13001.021 folder moved successfully.

c:\users\Sven\AppData\Roaming\13001.022\components folder moved successfully.

c:\users\Sven\AppData\Roaming\13001.022 folder moved successfully.

c:\users\Sven\AppData\Roaming\13001.033\components folder moved successfully.

c:\users\Sven\AppData\Roaming\13001.033 folder moved successfully.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Administrator

->Temp folder emptied: 0 bytes

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: Public

->Temp folder emptied: 0 bytes

 

User: Sven

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 1129869 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 64923646 bytes

->Flash cache emptied: 739 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 0 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 63,00 mb

 

 

OTL by OldTimer - Version 3.2.56.0 log created on 08082012_205031
 

Files\Folders moved on Reboot...

C:\Users\Sven\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
 

PendingFileRenameOperations files...

File C:\Users\Sven\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
 

Registry entries deleted on Reboot...

Ich kann die combo-fix -dateien jetzt öffnen ich poste die gleich mit:
ComboFix.txt

Code:

ComboFix 12-08-07.05 - Sven 08.08.2012  18:20:33.1.2 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3071.1692 [GMT 2:00]

ausgeführt von:: c:\users\Sven\Downloads\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Sven\AppData\Roaming\AcroIEHelpe.txt

c:\users\Sven\AppData\Roaming\srvblck5.tmp

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-07-08 bis 2012-08-08  ))))))))))))))))))))))))))))))

.

.

2012-08-08 04:50 . 2012-08-08 04:50        --------        d-----w-        c:\windows\Internet Logs

2012-08-07 15:09 . 2012-08-08 15:56        --------        d-----w-        c:\programdata\Spybot - Search & Destroy

2012-08-07 13:21 . 2012-06-29 10:04        9133488        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{5DAA11FA-DB4D-4912-BF95-99FC6C08E3E4}\mpengine.dll

2012-08-06 15:21 . 2012-08-06 15:21        --------        d-----w-        C:\_OTL

2012-08-05 23:00 . 2012-08-05 23:00        --------        d-----w-        c:\program files (x86)\7-Zip

2012-08-05 22:20 . 2012-08-05 22:20        --------        d-----w-        c:\users\Sven\AppData\Roaming\Malwarebytes

2012-08-05 22:19 . 2012-08-05 22:19        --------        d-----w-        c:\programdata\Malwarebytes

2012-08-03 16:33 . 2012-08-03 16:33        --------        d-----w-        c:\users\Sven\AppData\Roaming\13001.033

2012-07-30 18:33 . 2012-07-31 11:30        --------        d-----w-        c:\users\Sven\AppData\Roaming\Tropico 3

2012-07-30 07:36 . 2012-07-30 07:36        --------        d-----w-        c:\program files (x86)\AMD APP

2012-07-30 07:34 . 2012-07-30 07:34        --------        d-----w-        C:\AMD

2012-07-29 13:53 . 2012-07-29 13:53        --------        d-----w-        c:\users\Sven\AppData\Local\Macromedia

2012-07-29 05:46 . 2012-07-29 05:46        426184        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2012-07-12 12:50 . 2012-08-05 20:13        --------        d-----w-        c:\users\Sven\AppData\Local\ElevatedDiagnostics

2012-07-11 22:15 . 2012-06-12 03:08        3148800        ----a-w-        c:\windows\system32\win32k.sys

2012-07-11 12:31 . 2012-07-11 22:02        --------        d-----w-        c:\users\Sven\AppData\Roaming\13001.022

2012-07-11 07:54 . 2012-07-05 11:02        95744        ----a-w-        c:\windows\system32\pdfcmon.dll

2012-07-11 07:54 . 2005-04-15 18:58        1071088        ----a-w-        c:\windows\SysWow64\MSCOMCTL.OCX

2012-07-11 07:54 . 2004-03-08 23:00        662288        ----a-w-        c:\windows\SysWow64\MSCOMCT2.OCX

2012-07-11 07:54 . 1998-06-23 23:00        137000        ----a-w-        c:\windows\SysWow64\MSMAPI32.OCX

2012-07-11 07:54 . 2012-07-11 07:55        --------        d-----w-        c:\program files (x86)\PDFCreator

2012-07-11 07:54 . 1998-07-06 16:56        125712        ----a-w-        c:\windows\SysWow64\VB6DE.DLL

2012-07-11 07:54 . 1998-07-06 16:55        158208        ----a-w-        c:\windows\SysWow64\MSCMCDE.DLL

2012-07-11 07:54 . 1998-07-06 16:55        64512        ----a-w-        c:\windows\SysWow64\MSCC2DE.DLL

2012-07-11 07:54 . 1998-07-05 23:00        23552        ----a-w-        c:\windows\SysWow64\MSMPIDE.DLL

2012-07-11 01:00 . 2010-02-23 08:16        294912        ----a-w-        c:\windows\system32\browserchoice.exe

2012-07-10 12:42 . 2012-07-10 12:42        --------        d-----w-        c:\users\Sven\AppData\Roaming\13001.021

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-07-29 05:46 . 2012-01-07 12:08        70344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-07-11 22:12 . 2012-01-07 11:28        59701280        ----a-w-        c:\windows\system32\MRT.exe

2012-06-11 11:50 . 2012-06-11 11:50        187392        ----a-w-        c:\windows\system32\clinfo.exe

2012-06-11 11:50 . 2012-06-11 11:50        75264        ----a-w-        c:\windows\system32\OpenVideo64.dll

2012-06-11 11:50 . 2012-06-11 11:50        65024        ----a-w-        c:\windows\SysWow64\OpenVideo.dll

2012-06-11 11:50 . 2012-06-11 11:50        63488        ----a-w-        c:\windows\system32\OVDecode64.dll

2012-06-11 11:50 . 2012-06-11 11:50        56320        ----a-w-        c:\windows\SysWow64\OVDecode.dll

2012-06-11 11:50 . 2012-06-11 11:50        16457728        ----a-w-        c:\windows\system32\amdocl64.dll

2012-06-11 11:49 . 2012-06-11 11:49        13008896        ----a-w-        c:\windows\SysWow64\amdocl.dll

2012-06-11 11:48 . 2012-06-11 11:48        54784        ----a-w-        c:\windows\system32\OpenCL.dll

2012-06-11 11:48 . 2012-06-11 11:48        50176        ----a-w-        c:\windows\SysWow64\OpenCL.dll

2012-06-02 22:19 . 2012-06-21 05:10        38424        ----a-w-        c:\windows\system32\wups.dll

2012-06-02 22:19 . 2012-06-21 05:10        2428952        ----a-w-        c:\windows\system32\wuaueng.dll

2012-06-02 22:19 . 2012-06-21 05:10        57880        ----a-w-        c:\windows\system32\wuauclt.exe

2012-06-02 22:19 . 2012-06-21 05:10        44056        ----a-w-        c:\windows\system32\wups2.dll

2012-06-02 22:19 . 2012-06-21 05:10        701976        ----a-w-        c:\windows\system32\wuapi.dll

2012-06-02 22:15 . 2012-06-21 05:10        2622464        ----a-w-        c:\windows\system32\wucltux.dll

2012-06-02 22:15 . 2012-06-21 05:10        99840        ----a-w-        c:\windows\system32\wudriver.dll

2012-06-02 13:19 . 2012-06-21 05:09        186752        ----a-w-        c:\windows\system32\wuwebv.dll

2012-06-02 13:15 . 2012-06-21 05:09        36864        ----a-w-        c:\windows\system32\wuapp.exe

2012-05-31 10:25 . 2010-11-21 03:27        279656        ------w-        c:\windows\system32\MpSigStub.exe

2012-05-15 04:01 . 2012-06-12 20:53        1188864        ----a-w-        c:\windows\system32\wininet.dll

2012-05-15 03:59 . 2012-06-12 20:53        64512        ----a-w-        c:\windows\system32\jsproxy.dll

2012-05-15 03:03 . 2012-06-12 20:53        981504        ----a-w-        c:\windows\SysWow64\wininet.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"KPeerNexonEU"="c:\nexon\NEXON_EU_Downloader\nxEULauncher.exe" [2012-01-07 438272]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-02-29 17148552]

"Steam"="c:\program files (x86)\Steam\Steam.exe" [2012-08-04 1353080]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-11-09 343168]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2011-12-09 74752]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

.

c:\users\Sven\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-29 158856]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]

R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys [2010-07-28 29720]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-16 113120]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-12-15 27760]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-11-10 204288]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-08 86224]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2011-11-10 10567680]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2011-11-10 325632]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-02-23 95760]

S3 yukonw7;NDIS6.2-Miniporttreiber für Marvell Yukon-Ethernet-Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=bd644b47-58ed-4b7b-bc74-bf24ec626530&affid=110774&searchtype=hp&babsrc=lnkry_nt

mLocal Page = c:\windows\SysWOW64\blank.htm

uSearchAssistant = 

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\Sven\AppData\Roaming\Mozilla\Firefox\Profiles\ak3ecn9e.default\

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.10"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-08-08  18:29:44 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-08-08 16:29

.

Vor Suchlauf: 13 Verzeichnis(se), 231.276.748.800 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 230.872.600.576 Bytes frei

.

- - End Of File - - DA0ED50A27DE9AF8BA08DB41235464A6

Qoobox\Add-Remove Programs.txt:

Code:

7-Zip 9.20

Adobe Flash Player 11 Plugin

Adobe Reader X (10.1.3) - Deutsch

Avira Free Antivirus

Bandisoft MPEG-1 Decoder

BattleForge™

Catalyst Control Center

Catalyst Control Center - Branding

Catalyst Control Center Graphics Previews Common

CCC Help English

Counter-Strike: Source

Counter-Strike: Source Beta

Diablo III

Drakensang

EverQuest II

Java Auto Updater

Java(TM) 6 Update 31

Linkury Smartbar

Magic: The Gathering - Duels of the Planeswalkers 2013

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

Mozilla Firefox 13.0.1 (x86 de)

Mozilla Maintenance Service

Nexon Game Manager

OpenOffice.org 3.3

PDFCreator

Skype Click to Call

Skype™ 5.8

Steam

Tropico 3: Absolute Power

Ubisoft Game Launcher

Vindictus EU

Winamp

Winamp Erkennungs-Plug-in

WinRAR 4.10 (32-Bit)

World of Tanks v.0.7.1