Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   GEMA Trojaner - Windows XP (https://www.trojaner-board.de/105112-gema-trojaner-windows-xp.html)

jotak 15.11.2011 14:39
GEMA Trojaner - Windows XP
 
Hallo,

ich habe die Schritte von anderen Threads gefolgt:
download:
hxxp://oldtimer.geekstogo.com/OTLPENet.exe
und brenne es mit ISOBurner auf eine CD.
ISO Burner Download - ISO Burner 2.5
Ich habe es getan obwohl es keine ISO-Datei war, ich habe es als "Bootable CD" mit Roxio Creator gemacht.
Starte dein System neu und boote von der CD die du gerade erstellt hast.
Wenn du nicht weist wie du deinen Computer dazu bringst von der CD zu booten,
Computer von CD booten
Ich habe es gemacht, aber dann kommt sofort folgende Meldung:
"Operative System missing" (auf einem schwarzen Fenster)

Ich habe auch das ISO BURN Programm, um die CD zu generieren, und es kommt folgende Meldung:
"Selected Boot Device failed." (auf einem schwarzen Fenster)

Weiß jemand wie ich weiter machen kann, bzw. ob es eine andere Methode gibt?

Viele Grüße und vielen Dank

jotak 15.11.2011 16:14
Bitte nicht antworten,
ich hatte die ISO-Datei falsch auf dem CD gebrannt.

cosinus 15.11.2011 16:14
Zitat:
ich habe die Schritte von anderen Threads gefolgt:
Nein, du hast die Anleitung falsch umgesetzt.
Es ist in der Anleitung nicht die Rede davon, dass du die EXE auf eine CD brennen sollst. Eine EXE ist kein Abbild.
Du kannst die OTLPENET.EXE aber mit einem Rechtsklick entpacken wenn zB 7zip installiert ist. Im Extrakt ist eine ISO-Datei und diese ist das Abbild der CD.

jotak 16.11.2011 14:17
Hier ist die OTL Log:OTL Logfile:
Code:
OTL logfile created on: 11/15/2011 6:52:40 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 87.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 53.71 Gb Total Space | 19.16 Gb Free Space | 35.67% Space Free | Partition Type: NTFS
Drive D: | 95.33 Gb Total Space | 1.34 Gb Free Space | 1.41% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet003
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011/02/18 09:37:16 | 000,037,664 | ---- | M] (Apple Inc.) [Auto] -- C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/11/18 06:09:24 | 000,330,696 | ---- | M] () [Auto] -- C:\Programme\Verbindungsassistent\WTGService.exe -- (WTGService)
SRV - [2010/01/06 10:15:39 | 003,391,488 | ---- | M] (IBM Corp) [Auto] -- C:\Programme\IBM\Lotus\Notes\nsd.exe -- (Lotus Notes Diagnostics)
SRV - [2009/11/12 07:48:56 | 000,071,096 | ---- | M] () [Auto] -- C:\Programme\CDBurner\NMSAccessU.exe -- (NMSAccessU)
SRV - [2009/11/12 03:59:22 | 000,083,312 | ---- | M] (TOSHIBA Corporation) [Auto] -- C:\Programme\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe -- (TNaviSrv)
SRV - [2009/10/21 03:39:00 | 000,148,848 | ---- | M] (TOSHIBA CORPORATION) [Auto] -- C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service)
SRV - [2009/09/29 05:30:00 | 000,058,760 | ---- | M] (IBM Corp) [Auto] -- C:\Programme\IBM\Lotus\Notes\ntmulti.exe -- (Multi-user Cleanup Service)
SRV - [2009/09/17 11:56:00 | 002,477,304 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2009/09/17 11:38:00 | 001,864,888 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService)
SRV - [2009/09/17 11:21:00 | 000,341,320 | ---- | M] (Symantec Corporation) [Disabled] -- C:\Programme\Symantec\Symantec Endpoint Protection\SNAC.EXE -- (SNAC)
SRV - [2009/08/18 12:23:16 | 003,093,880 | ---- | M] (Symantec Corporation) [On_Demand] -- C:\Programme\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate)
SRV - [2009/07/08 14:14:20 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)
SRV - [2009/07/08 14:14:20 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)
SRV - [2009/04/16 09:24:10 | 000,069,632 | ---- | M] (hxxp://www.ocsinventory-ng.org) [Auto] -- C:\Programme\OCS Inventory Agent\ocsservice.exe -- (OCS INVENTORY)
SRV - [2009/03/27 12:10:56 | 000,014,336 | ---- | M] (LSI Corporation) [Auto] -- C:\Programme\LSI SoftModem\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2008/09/18 08:09:00 | 000,131,072 | ---- | M] (AuthenTec,Inc) [On_Demand] -- C:\WINDOWS\system32\FpLogonServ.exe -- (FingerprintServer)
SRV - [2008/09/02 00:06:00 | 000,049,152 | ---- | M] (AuthenTec Inc.) [Auto] -- C:\WINDOWS\system32\TAMSvr.exe -- (Authentec memory manager)
SRV - [2008/08/25 19:26:18 | 000,242,424 | ---- | M] (WildTangent, Inc.) [On_Demand] -- C:\Programme\WildGames\Game Console - WildGames\GameConsoleService.exe -- (GameConsoleService)
SRV - [2008/08/07 02:35:12 | 000,040,960 | ---- | M] (TOSHIBA CORPORATION) [Auto] -- C:\Programme\Toshiba\ConfigFree\CFSvcs.exe -- (CFSvcs)
SRV - [2008/07/25 08:07:30 | 000,551,736 | ---- | M] (TOSHIBA Corporation) [Auto] -- C:\WINDOWS\system32\ThpSrv.exe -- (Thpsrv)
SRV - [2006/01/19 13:51:20 | 000,118,784 | ---- | M] (TOSHIBA) [Auto] -- C:\Programme\TOSHIBA\TME3\Tmesrv31.exe -- (Tmesrv)
SRV - [2004/10/21 20:24:18 | 000,073,728 | ---- | M] (Macrovision Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT)
SRV - [2003/07/28 06:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2003/06/19 17:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand] --  -- (WDICA)
DRV - File not found [Kernel | On_Demand] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand] --  -- (PDCOMP)
DRV - File not found [Kernel | System] --  -- (PCIDump)
DRV - File not found [Kernel | System] --  -- (lbrtfdc)
DRV - File not found [Kernel | System] --  -- (Changer)
DRV - [2011/11/12 04:00:00 | 000,374,392 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2011/11/12 04:00:00 | 000,106,104 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2011/09/13 13:56:44 | 000,102,784 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV - [2011/09/13 13:56:43 | 000,106,496 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2011/08/18 03:00:00 | 001,576,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20111114.004\NAVEX15.SYS -- (NAVEX15)
DRV - [2011/08/18 03:00:00 | 000,086,136 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\VirusDefs\20111114.004\NAVENG.SYS -- (NAVENG)
DRV - [2011/08/04 17:30:50 | 000,103,040 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ewusbfake.sys -- (hwusbfake)
DRV - [2011/08/04 17:30:50 | 000,100,224 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ewsercd.sys -- (ewsercd)
DRV - [2010/02/24 14:02:38 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2010/01/13 02:24:42 | 006,598,656 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\NETw5x32.sys -- (NETw5x32) Intel(R)
DRV - [2009/11/12 07:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2009/11/12 03:46:02 | 000,279,376 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\tos_sps32.sys -- (tos_sps32)
DRV - [2009/10/28 05:35:10 | 005,937,152 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2009/10/21 05:22:00 | 000,298,752 | ---- | M] () [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2009/10/20 07:10:30 | 000,241,880 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\e1y5132.sys -- (e1yexpress) Intel(R)
DRV - [2009/09/24 10:54:00 | 000,169,320 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tosrfbd.sys -- (tosrfbd)
DRV - [2009/09/14 07:29:00 | 000,049,400 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tosrfusb.sys -- (Tosrfusb)
DRV - [2009/09/03 10:03:48 | 000,188,080 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - [2009/09/03 10:03:48 | 000,026,416 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV - [2009/08/26 05:54:38 | 000,421,424 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\Programme\Gemeinsame Dateien\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2009/08/25 14:05:44 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System] -- C:\WINDOWS\system32\drivers\srtspx.sys -- (SRTSPX)
DRV - [2009/08/25 14:05:42 | 000,320,560 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\srtspl.sys -- (SRTSPL)
DRV - [2009/08/25 14:05:42 | 000,281,648 | ---- | M] (Symantec Corporation) [File_System | System] -- C:\WINDOWS\system32\drivers\srtsp.sys -- (SRTSP)
DRV - [2009/08/10 09:54:00 | 000,059,888 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\TosRfSnd.sys -- (TosRfSnd)
DRV - [2009/07/28 13:01:00 | 000,069,480 | ---- | M] (TOSHIBA Corporation) [Kernel | System] -- C:\WINDOWS\system32\drivers\tosrfcom.sys -- (Tosrfcom)
DRV - [2009/07/24 04:31:00 | 000,021,608 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tosrfnds.sys -- (tosrfnds)
DRV - [2009/07/14 06:51:12 | 000,023,888 | ---- | M] (Symantec Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\COH_Mon.sys -- (COH_Mon)
DRV - [2009/07/13 15:13:00 | 000,015,216 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tosrfec.sys -- (tosrfec)
DRV - [2009/06/23 07:49:58 | 000,040,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\HECI.sys -- (HECI) Intel(R)
DRV - [2009/06/17 04:59:00 | 000,046,984 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tosporte.sys -- (tosporte)
DRV - [2009/06/11 07:05:00 | 000,036,992 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tosrfbnp.sys -- (tosrfbnp)
DRV - [2009/05/20 03:23:00 | 000,074,368 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Tosrfhid.sys -- (Tosrfhid)
DRV - [2008/10/09 06:29:40 | 000,166,448 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Apfiltr.sys -- (ApfiltrService)
DRV - [2008/08/14 02:52:00 | 000,146,944 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (SwipeSensor)
DRV - [2008/08/07 02:35:48 | 000,041,216 | ---- | M] (Infineon Technologies AG) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ifxtpm.sys -- (IFXTPM)
DRV - [2008/08/07 02:35:08 | 000,038,400 | ---- | M] (REDC) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2008/08/07 02:35:06 | 000,046,592 | ---- | M] (REDC) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2008/08/07 02:35:04 | 000,043,008 | ---- | M] (REDC) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2008/08/07 02:34:10 | 000,012,032 | ---- | M] (TOSHIBA Corporation.) [Kernel | Auto] -- C:\WINDOWS\system32\drivers\Netdevio.sys -- (Netdevio)
DRV - [2008/08/07 02:33:34 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2008/08/05 14:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2008/07/25 08:41:36 | 000,042,608 | ---- | M] (Alfa Corporation) [File_System | Boot] -- C:\WINDOWS\system32\drivers\AlfaFF.sys -- (AlfaFF)
DRV - [2008/07/09 02:39:28 | 000,027,768 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\thpdrv.sys -- (Thpdrv)
DRV - [2007/09/04 03:14:06 | 000,006,528 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\Thpevm.sys -- (Thpevm)
DRV - [2007/02/21 11:20:36 | 000,435,072 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\TEchoCan.sys -- (TEchoCan)
DRV - [2007/02/15 09:44:06 | 000,016,768 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\TVALZ.SYS -- (TVALZ)
DRV - [2006/07/18 03:51:40 | 000,041,600 | R--- | M] (JMicron Technology Corp.) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\Jraid.sys -- (JRAID)
DRV - [2006/02/14 12:50:52 | 000,216,320 | ---- | M] (TOSHIBA CORPORATION) [Kernel | Boot] -- C:\WINDOWS\system32\drivers\KR10I.sys -- (KR10I)
DRV - [2006/01/04 09:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2004/06/16 04:08:48 | 000,005,888 | ---- | M] (Toshiba Corporation) [Kernel | System] -- C:\WINDOWS\system32\drivers\TMEI3E.sys -- (TMEI3E)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B0 A2 6D 18 9B C6 CA 01  [binary data]
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\jgonzalez_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2849855
IE - HKU\jgonzalez_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\jgonzalez_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\jgonzalez_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B0 A2 6D 18 9B C6 CA 01  [binary data]
IE - HKU\jgonzalez_ON_C\..\URLSearchHook: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Programme\BittorrentBar_DE\tbBit1.dll (Conduit Ltd.)
IE - HKU\jgonzalez_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\jgonzalez_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://search.conduit.com/?ctid=CT2849855&SearchSource=13"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.1
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.0.900
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.0.900
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4}:3.3.3.2
FF - prefs.js..network.proxy.autoconfig_url: "hxxp://www.beone-group.com/proxy.pac"
FF - prefs.js..network.proxy.type: 2
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Programme\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX OVS Helper,version=1.0.0: C:\Programme\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Programme\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Programme\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ClickPotatoLite@ClickPotatoLite.com: C:\Programme\ClickPotatoLite\bin\10.0.622.0\firefox\extensions
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Programme\DivX\DivX Plus Web Player\firefox\html5video [2010/12/12 16:43:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Programme\DivX\DivX Plus Web Player\firefox\wpa [2010/12/12 16:43:27 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011/07/06 16:24:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.18\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011/07/06 16:24:35 | 000,000,000 | ---D | M]
 
[2010/03/18 08:04:41 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Extensions
[2011/11/14 10:50:08 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions
[2010/08/29 09:09:03 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/04/13 15:02:48 | 000,000,000 | ---D | M] (BittorrentBar_DE Community Toolbar) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}
[2011/03/31 14:55:47 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011/04/13 15:02:49 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\engine@conduit.com
[2011/11/13 18:02:17 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2010/06/17 04:20:30 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/12/12 16:43:27 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 <video>) -- C:\PROGRAMME\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\HTML5VIDEO
[2010/12/12 16:43:27 | 000,000,000 | ---D | M] (DivX HiQ) -- C:\PROGRAMME\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\WPA
[2010/06/17 04:20:23 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/03/01 15:45:30 | 000,289,592 | ---- | M] (Cisco WebEx LLC) -- C:\Programme\mozilla firefox\plugins\ieatgpc.dll
[2011/03/01 15:43:34 | 000,171,832 | ---- | M] (Cisco WebEx LLC) -- C:\Programme\mozilla firefox\plugins\npatgpc.dll
[2010/11/16 15:47:42 | 000,087,344 | ---- | M] (Pinball Corporation.) -- C:\Programme\mozilla firefox\plugins\npclntax_ClickPotatoLiteSA.dll
[2010/06/17 04:20:22 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll
[2011/04/03 05:51:24 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/04/03 05:51:24 | 000,002,344 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2011/04/03 05:51:24 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/04/03 05:51:24 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/04/03 05:51:24 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2004/08/04 07:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngin0.dll (Conduit Ltd.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Programme\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (BittorrentBar_DE Toolbar) - {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Programme\BittorrentBar_DE\tbBit1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngin0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (BittorrentBar_DE Toolbar) - {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Programme\BittorrentBar_DE\tbBit1.dll (Conduit Ltd.)
O3 - HKU\jgonzalez_ON_C\..\Toolbar\WebBrowser: (BittorrentBar_DE Toolbar) - {64EAD72B-FFD4-4E01-AA3A-4C71665D73E4} - C:\Programme\BittorrentBar_DE\tbBit1.dll (Conduit Ltd.)
O4 - HKLM..\Run: [000StTHK] C:\WINDOWS\System32\000StTHK.exe ()
O4 - HKLM..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ccApp] C:\Programme\Gemeinsame Dateien\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [CoolSwitch] C:\WINDOWS\system32\TaskSwitch.exe ()
O4 - HKLM..\Run: [DivX Download Manager] C:\Programme\DivX\DivX Plus Web Player\DDmService.exe (DivX, LLC)
O4 - HKLM..\Run: [DivXUpdate] C:\Programme\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [FingerPrintNotifer] C:\Programme\TrueSuite Access Manager\FpNotifier.exe (AuthenTec, Inc)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [IawTkqZr8KqZoeE] C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe (Nubia Lyman )
O4 - HKLM..\Run: [ITSecMng] C:\Programme\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [NDSTray.exe]  File not found
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
O4 - HKLM..\Run: [PwdBank] C:\Programme\TrueSuite Access Manager\PwdBank.exe (Arachnoid Biometrics Identification Group)
O4 - HKLM..\Run: [Standarddrucker] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [TAudEffect] C:\Programme\TOSHIBA\TAudEffect\TAudEff.exe (TOSHIBA)
O4 - HKLM..\Run: [TFncKy]  File not found
O4 - HKLM..\Run: [TFNF5] C:\WINDOWS\System32\TFNF5.exe (TOSHIBA Corp.)
O4 - HKLM..\Run: [ThpSrv] C:\WINDOWS\System32\thpsrv.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TMERzCtl.EXE] C:\Programme\TOSHIBA\TME3\TMERzCtl.EXE (TOSHIBA)
O4 - HKLM..\Run: [TMESRV.EXE] C:\Programme\TOSHIBA\TME3\TMESRV31.EXE (TOSHIBA)
O4 - HKLM..\Run: [TNRotate] C:\Programme\Toshiba\TNROTATE\TNROTATE.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TosHKCW.exe] C:\Programme\TOSHIBA\Wireless Hotkey\TosHKCW.exe (TOSHIBA CORPORATION)
O4 - HKLM..\Run: [TouchED] C:\Programme\Toshiba\TouchED\TouchED.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPSMain] C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TPSODDCtl] C:\WINDOWS\System32\TPSODDCtl.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [UsbMonitor] C:\Programme\TrueSuite Access Manager\usbnotify.exe ()
O4 - HKU\Administrator_ON_C..\Run: [TOSCDSPD] C:\Programme\Toshiba\TOSCDSPD\TOSCDSPD.exe (TOSHIBA)
O4 - HKU\jgonzalez_ON_C..\Run: [BitTorrent] C:\Programme\BitTorrent\BitTorrent.exe (BitTorrent, Inc.)
O4 - HKU\jgonzalez_ON_C..\Run: [dj56jud56u] C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\ftuftu56.exe (Mellon Ferrer )
O4 - HKU\jgonzalez_ON_C..\Run: [gay5y5a] C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\adfshare34.exe (Nubia Lyman )
O4 - HKU\jgonzalez_ON_C..\Run: [IawTkqZr8KqZoeE] C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe (Nubia Lyman )
O4 - HKU\jgonzalez_ON_C..\Run: [Windows Update] C:\Dokumente und Einstellungen\jgonzalez\Lokale Einstellungen\Anwendungsdaten\winvv.exe (Mellon Ferrer )
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Bluetooth Manager.lnk = C:\Programme\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\PC Health.lnk = C:\Programme\Toshiba\TOSHIBA Management Console\TOSHealthLocalS.vbs ()
O4 - Startup: C:\Dokumente und Einstellungen\jgonzalez\Startmenü\Programme\Autostart\Dropbox.lnk = C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Dokumente und Einstellungen\jgonzalez\Startmenü\Programme\Autostart\OpenOffice.org 2.0.lnk = C:\Programme\OpenOffice.org 2.0\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\Administrator_ON_C\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\jgonzalez_ON_C\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\jgonzalez_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\jgonzalez_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1
O7 - HKU\jgonzalez_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1
O7 - HKU\jgonzalez_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O7 - HKU\LocalService_ON_C\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\NetworkService_ON_C\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\systemprofile_ON_C\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - C:\Programme\Microsoft Office 2003\OFFICE11\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office 2003\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1267030794732 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1267031008732 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = net.beone-group.com
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe) - C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe (Nubia Lyman )
O20 - HKLM Winlogon: GinaDLL - (TAM_GINA.dll) - C:\WINDOWS\System32\TAM_GINA.dll (AuthenTec, Inc.)
O20 - HKU\jgonzalez_ON_C Winlogon: Shell - (C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe) - C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe (Nubia Lyman )
O20 - Winlogon\Notify\ATFUS: DllName - C:\WINDOWS\system32\FpWinLogonNp.dll - C:\WINDOWS\system32\FpWinlogonNp.dll (AuthenTec,Inc)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\WINDOWS\BeOneBackground.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\BeOneBackground.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/24 11:30:45 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{05b226aa-7dd7-11df-a596-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{05b226aa-7dd7-11df-a596-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{05b226aa-7dd7-11df-a596-00215d62b644}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{4c1b7022-bab0-11df-a59d-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{4c1b7022-bab0-11df-a59d-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{4c1b7022-bab0-11df-a59d-00215d62b644}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{4c1b7023-bab0-11df-a59d-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{4c1b7023-bab0-11df-a59d-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{4c1b7023-bab0-11df-a59d-00215d62b644}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5356705a-b374-11df-a597-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{5356705a-b374-11df-a597-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5356705a-b374-11df-a597-00215d62b644}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5356705d-b374-11df-a597-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{5356705d-b374-11df-a597-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5356705d-b374-11df-a597-00215d62b644}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9b0280bc-bee8-11e0-a625-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{9b0280bc-bee8-11e0-a625-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9b0280bc-bee8-11e0-a625-00215d62b644}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{9b0280be-bee8-11e0-a625-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{9b0280be-bee8-11e0-a625-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9b0280be-bee8-11e0-a625-00215d62b644}\Shell\AutoRun\command - "" = E:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{aa1811a6-20d8-11e0-a5d2-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{aa1811a6-20d8-11e0-a5d2-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{aa1811a6-20d8-11e0-a5d2-00215d62b644}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e09951a6-cbf9-11df-a5a7-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{e09951a6-cbf9-11df-a5a7-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e09951a6-cbf9-11df-a5a7-00215d62b644}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e09951a7-cbf9-11df-a5a7-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{e09951a7-cbf9-11df-a5a7-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e09951a7-cbf9-11df-a5a7-00215d62b644}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011/11/14 15:50:34 | 000,370,176 | ---- | C] (Nubia Lyman ) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe
[2011/11/14 15:50:34 | 000,095,744 | ---- | C] (Kassl GmbH) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\dwlGina3.dll
[2011/11/14 15:50:17 | 000,370,176 | ---- | C] (Nubia Lyman ) -- C:\Dokumente und Einstellungen\jgonzalez\Lokale Einstellungen\Anwendungsdaten\gemacasherdec3.exe
[2011/11/14 15:50:17 | 000,370,176 | ---- | C] (Nubia Lyman ) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\adfshare34.exe
[2011/11/14 15:50:08 | 000,050,176 | ---- | C] (Mellon Ferrer ) -- C:\Dokumente und Einstellungen\jgonzalez\Lokale Einstellungen\Anwendungsdaten\winvv.exe
[2011/11/14 15:49:50 | 000,050,176 | ---- | C] (Mellon Ferrer ) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\ftuftu56.exe
[2011/11/13 17:42:52 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011/11/15 12:39:54 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/11/15 12:39:31 | 000,001,092 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/11/15 12:39:08 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/11/14 16:14:04 | 000,001,096 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/11/14 15:50:34 | 000,095,744 | ---- | M] (Kassl GmbH) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\dwlGina3.dll
[2011/11/14 15:50:26 | 000,370,176 | ---- | M] (Nubia Lyman ) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe
[2011/11/14 15:50:26 | 000,370,176 | ---- | M] (Nubia Lyman ) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\adfshare34.exe
[2011/11/14 15:50:20 | 000,370,176 | ---- | M] (Nubia Lyman ) -- C:\Dokumente und Einstellungen\jgonzalez\Lokale Einstellungen\Anwendungsdaten\gemacasherdec3.exe
[2011/11/14 15:50:00 | 000,050,176 | ---- | M] (Mellon Ferrer ) -- C:\Dokumente und Einstellungen\jgonzalez\Lokale Einstellungen\Anwendungsdaten\winvv.exe
[2011/11/14 15:50:00 | 000,050,176 | ---- | M] (Mellon Ferrer ) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\ftuftu56.exe
[2011/11/14 15:09:51 | 000,000,276 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/11/14 15:09:50 | 000,001,830 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Apple Software Update.lnk
[2011/11/14 14:48:10 | 000,190,394 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011/11/14 11:15:23 | 000,001,783 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Google Chrome.lnk
[2011/11/14 03:32:54 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/11/13 17:42:52 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/11/06 12:14:01 | 000,054,272 | ---- | M] () -- C:\Dokumente und Einstellungen\jgonzalez\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/11/06 11:27:57 | 000,272,576 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/11/03 15:50:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Microsoft Silverlight
[2011/11/03 15:47:00 | 000,467,566 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2011/11/03 15:47:00 | 000,448,396 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/11/03 15:47:00 | 000,088,838 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2011/11/03 15:47:00 | 000,074,378 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011/03/03 06:48:34 | 000,000,600 | ---- | C] () -- C:\Dokumente und Einstellungen\jgonzalez\Lokale Einstellungen\Anwendungsdaten\PUTTY.RND
[2010/11/21 10:12:36 | 000,815,104 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010/11/21 10:12:35 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010/08/29 11:52:47 | 000,054,272 | ---- | C] () -- C:\Dokumente und Einstellungen\jgonzalez\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/06/17 04:17:19 | 000,005,262 | RHS- | C] () -- C:\Dokumente und Einstellungen\jgonzalez\ntuser.pol
[2010/06/17 02:09:07 | 000,000,000 | ---- | C] () -- C:\WINDOWS\NDSTray.INI
[2010/06/17 01:53:03 | 000,128,113 | ---- | C] () -- C:\WINDOWS\System32\csellang.ini
[2010/06/17 01:53:03 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\csellang.dll
[2010/06/17 01:53:03 | 000,010,150 | ---- | C] () -- C:\WINDOWS\System32\tosmreg.ini
[2010/06/17 01:53:03 | 000,007,671 | ---- | C] () -- C:\WINDOWS\System32\cseltbl.ini
[2010/06/17 01:52:23 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\000StTHK.exe
[2010/03/24 13:23:14 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2010/03/10 14:52:04 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2010/02/25 09:53:57 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2010/02/25 09:53:57 | 001,630,208 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe
[2010/02/25 09:53:57 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2010/02/25 09:53:56 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2010/02/25 09:53:55 | 001,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2010/02/25 09:53:55 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe
[2010/02/25 09:53:54 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe
[2010/02/25 09:53:53 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe
[2010/02/24 14:06:01 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\StrmExt.dll
[2010/02/24 13:31:29 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2010/02/24 13:30:49 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2010/02/24 13:30:49 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe
[2010/02/24 13:26:13 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/02/24 13:25:59 | 000,000,106 | ---- | C] () -- C:\WINDOWS\Library.ini
[2010/02/24 13:18:09 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010/02/24 11:53:07 | 000,298,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\yk51x86.sys
[2010/02/24 11:32:37 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/02/24 11:28:07 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/02/24 11:20:51 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/02/24 11:19:47 | 000,272,576 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008/04/14 01:06:26 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2006/12/31 00:57:08 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2005/12/21 05:36:46 | 000,009,728 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2004/08/04 07:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/04 07:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/04 07:00:00 | 000,467,566 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat
[2004/08/04 07:00:00 | 000,448,396 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/04 07:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/04 07:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat
[2004/08/04 07:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/04 07:00:00 | 000,088,838 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat
[2004/08/04 07:00:00 | 000,074,378 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/04 07:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/04 07:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat
[2004/08/04 07:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/04 07:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/04 07:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2003/02/20 11:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002/10/17 11:16:36 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\TOSMgmt.dll
[2002/03/19 11:30:00 | 000,045,632 | ---- | C] () -- C:\WINDOWS\System32\TaskSwitch.exe
 
========== LOP Check ==========
 
[2010/06/17 01:55:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\toshiba
[2011/05/14 16:39:41 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\.#
[2010/11/21 11:53:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\12Voip
[2010/06/17 04:17:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\BeOne
[2011/11/14 15:49:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\BitTorrent
[2011/11/14 14:48:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\Dropbox
[2011/03/04 13:18:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\FileZilla
[2010/08/29 09:37:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\HandBrake
[2010/10/26 11:45:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\IrfanView
[2010/12/12 16:43:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\Local
[2011/11/13 17:43:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\PriceGong
[2011/05/14 16:32:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\Spotify
[2011/09/20 14:59:27 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\Verbindungsassistent
[2010/11/13 09:07:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\WildTangent
[2010/10/26 13:26:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\WindSolutions
[2010/09/17 16:46:15 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Verbindungsassistent
[2010/02/24 13:31:37 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Canneverbe Limited
[2010/02/24 13:30:49 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\FreePDF
[2010/02/24 13:27:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lotus
[2010/06/17 02:08:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TOSHIBA
[2010/11/13 09:07:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WildTangent
[2010/10/26 13:25:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\WindSolutions
[2010/08/30 14:06:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
 
========== Purity Check ==========
 
 
< End of report >
--- --- ---

cosinus 16.11.2011 15:14
Zitat:
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = net.beone-group.com
Das ist ja ein Büro-PC. Warum kümmert sich die EDV-Abteilung nicht um diesen Rechner?

jotak 16.11.2011 15:18
Hallo,

Ich bin auf Dienstreise und es wird mindestens 2 Monate bis ich wieder im Büro bin.

Die EDV-Abteilung hat nur als Lösung vorgeschlagen, es dorthin zu schicken damit sie es platt manchen. (ca. 2-3 Wochen ohne laptop, plus naher ohne Daten..)

Es wäre effizienter den Trojaner aus dem Laptop wegzuschaffen.

Wenn es geht, klar...

Viele Grüße
J

cosinus 16.11.2011 16:44
Und du hast auch Adminrechte auf dem Notebook?

jotak 16.11.2011 16:55
Ich habe sie heute bekommen

cosinus 16.11.2011 19:55
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B0 A2 6D 18 9B C6 CA 01  [binary data]
IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\jgonzalez_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2849855
IE - HKU\jgonzalez_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKU\jgonzalez_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\jgonzalez_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B0 A2 6D 18 9B C6 CA 01  [binary data]
IE - HKU\jgonzalez_ON_C\..\URLSearchHook: {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Programme\BittorrentBar_DE\tbBit1.dll (Conduit Ltd.)
IE - HKU\jgonzalez_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\jgonzalez_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
IE - HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - prefs.js..browser.startup.homepage: "http://search.conduit.com/?ctid=CT2849855&SearchSource=13"
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
[2011/04/13 15:02:48 | 000,000,000 | ---D | M] (BittorrentBar_DE Community Toolbar) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}
[2011/04/13 15:02:49 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\engine@conduit.com
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngin0.dll (Conduit Ltd.)
O2 - BHO: (BittorrentBar_DE Toolbar) - {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Programme\BittorrentBar_DE\tbBit1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Programme\ConduitEngine\ConduitEngin0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (BittorrentBar_DE Toolbar) - {64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - C:\Programme\BittorrentBar_DE\tbBit1.dll (Conduit Ltd.)
O3 - HKU\jgonzalez_ON_C\..\Toolbar\WebBrowser: (BittorrentBar_DE Toolbar) - {64EAD72B-FFD4-4E01-AA3A-4C71665D73E4} - C:\Programme\BittorrentBar_DE\tbBit1.dll (Conduit Ltd.)
O4 - HKLM..\Run: [IawTkqZr8KqZoeE] C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe (Nubia Lyman )
O4 - HKLM..\Run: [NDSTray.exe]  File not found
O4 - HKLM..\Run: [Standarddrucker] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - HKU\jgonzalez_ON_C..\Run: [dj56jud56u] C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\ftuftu56.exe (Mellon Ferrer )
O4 - HKU\jgonzalez_ON_C..\Run: [gay5y5a] C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\adfshare34.exe (Nubia Lyman )
O4 - HKU\jgonzalez_ON_C..\Run: [IawTkqZr8KqZoeE] C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe (Nubia Lyman )
O4 - HKU\jgonzalez_ON_C..\Run: [Windows Update] C:\Dokumente und Einstellungen\jgonzalez\Lokale Einstellungen\Anwendungsdaten\winvv.exe (Mellon Ferrer )
O20 - HKU\jgonzalez_ON_C Winlogon: Shell - (C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe) - C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe (Nubia Lyman )
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/24 11:30:45 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 06:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{05b226aa-7dd7-11df-a596-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{05b226aa-7dd7-11df-a596-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{05b226aa-7dd7-11df-a596-00215d62b644}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{4c1b7022-bab0-11df-a59d-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{4c1b7022-bab0-11df-a59d-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{4c1b7022-bab0-11df-a59d-00215d62b644}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{4c1b7023-bab0-11df-a59d-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{4c1b7023-bab0-11df-a59d-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{4c1b7023-bab0-11df-a59d-00215d62b644}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5356705a-b374-11df-a597-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{5356705a-b374-11df-a597-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5356705a-b374-11df-a597-00215d62b644}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{5356705d-b374-11df-a597-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{5356705d-b374-11df-a597-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{5356705d-b374-11df-a597-00215d62b644}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{9b0280bc-bee8-11e0-a625-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{9b0280bc-bee8-11e0-a625-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9b0280bc-bee8-11e0-a625-00215d62b644}\Shell\AutoRun\command - "" = G:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{9b0280be-bee8-11e0-a625-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{9b0280be-bee8-11e0-a625-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{9b0280be-bee8-11e0-a625-00215d62b644}\Shell\AutoRun\command - "" = E:\.\Autorun.exe AUTORUN=1
O33 - MountPoints2\{aa1811a6-20d8-11e0-a5d2-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{aa1811a6-20d8-11e0-a5d2-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{aa1811a6-20d8-11e0-a5d2-00215d62b644}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e09951a6-cbf9-11df-a5a7-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{e09951a6-cbf9-11df-a5a7-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e09951a6-cbf9-11df-a5a7-00215d62b644}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e09951a7-cbf9-11df-a5a7-00215d62b644}\Shell - "" = AutoRun
O33 - MountPoints2\{e09951a7-cbf9-11df-a5a7-00215d62b644}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{e09951a7-cbf9-11df-a5a7-00215d62b644}\Shell\AutoRun\command - "" = E:\AutoRun.exe
[2011/11/14 15:50:34 | 000,370,176 | ---- | C] (Nubia Lyman ) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe
[2011/11/14 15:50:34 | 000,095,744 | ---- | C] (Kassl GmbH) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\dwlGina3.dll
[2011/11/14 15:50:17 | 000,370,176 | ---- | C] (Nubia Lyman ) -- C:\Dokumente und Einstellungen\jgonzalez\Lokale Einstellungen\Anwendungsdaten\gemacasherdec3.exe
[2011/11/14 15:50:17 | 000,370,176 | ---- | C] (Nubia Lyman ) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\adfshare34.exe
[2011/11/14 15:50:08 | 000,050,176 | ---- | C] (Mellon Ferrer ) -- C:\Dokumente und Einstellungen\jgonzalez\Lokale Einstellungen\Anwendungsdaten\winvv.exe
[2011/11/14 15:49:50 | 000,050,176 | ---- | C] (Mellon Ferrer ) -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\ftuftu56.exe
[2011/05/14 16:39:41 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\.#
[2011/11/13 17:43:00 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\PriceGong
:Commands
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

jotak 22.11.2011 15:33
Hey,
es hat funktioniert aber nur bedingt...
Ich habe den OTL-Fix durchgeführt. Danach konnte ich mich wieder in mein WindowsXP mit jgonzalez anmelden.
Problem: Der Taskmanager ist immer noch ausgegraut und ich kann es nicht starten.
Problem2: Das WLAN funktioniert nicht mehr
Problem3: auf dem Desktop sind keine Icone mehr...

Das ist das Ergebnis nach dem FIX:

========== OTL ==========
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!
HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\jgonzalez_ON_C\Software\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\jgonzalez_ON_C\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
HKU\jgonzalez_ON_C\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!
HKU\jgonzalez_ON_C\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
Registry value HKEY_USERS\jgonzalez_ON_C\Software\Microsoft\Internet Explorer\URLSearchHooks\\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}\ deleted successfully.
C:\Programme\BittorrentBar_DE\tbBit1.dll moved successfully.
HKU\jgonzalez_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\jgonzalez_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKU\LocalService_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: "hxxp://search.conduit.com/?ctid=CT2849855&SearchSource=13" removed from browser.startup.homepage
Prefs.js: engine@conduit.com:3.3.3.2 removed from extensions.enabledItems
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}\searchplugin folder moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}\META-INF folder moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}\lib folder moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}\defaults folder moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}\components folder moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}\chrome folder moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4} folder moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\engine@conduit.com\searchplugin folder moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\engine@conduit.com\META-INF folder moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\engine@conduit.com\lib folder moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\engine@conduit.com\DualPackage folder moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\engine@conduit.com\defaults folder moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\engine@conduit.com\components folder moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\engine@conduit.com\chrome folder moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\mozilla\Firefox\Profiles\tqh72vl4.default\extensions\engine@conduit.com folder moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
C:\Programme\ConduitEngine\ConduitEngin0.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}\ not found.
File C:\Programme\BittorrentBar_DE\tbBit1.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
File C:\Programme\ConduitEngine\ConduitEngin0.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64ead72b-ffd4-4e01-aa3a-4c71665d73e4}\ not found.
File C:\Programme\BittorrentBar_DE\tbBit1.dll not found.
Registry value HKEY_USERS\jgonzalez_ON_C\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{64EAD72B-FFD4-4E01-AA3A-4C71665D73E4} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64EAD72B-FFD4-4E01-AA3A-4C71665D73E4}\ not found.
File C:\Programme\BittorrentBar_DE\tbBit1.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\IawTkqZr8KqZoeE not found.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\NDSTray.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Standarddrucker deleted successfully.
C:\WINDOWS\system32\cmd.exe moved successfully.
Registry value HKEY_USERS\jgonzalez_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\dj56jud56u deleted successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\ftuftu56.exe moved successfully.
Registry value HKEY_USERS\jgonzalez_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\gay5y5a deleted successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\adfshare34.exe moved successfully.
Registry value HKEY_USERS\jgonzalez_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\IawTkqZr8KqZoeE deleted successfully.
File C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe not found.
Registry value HKEY_USERS\jgonzalez_ON_C\Software\Microsoft\Windows\CurrentVersion\Run\\Windows Update deleted successfully.
C:\Dokumente und Einstellungen\jgonzalez\Lokale Einstellungen\Anwendungsdaten\winvv.exe moved successfully.
Registry value HKEY_USERS\jgonzalez_ON_C\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe deleted successfully.
File C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe not found.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\AUTOEXEC.BAT moved successfully.
File move failed. X:\AUTORUN.INF scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{05b226aa-7dd7-11df-a596-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05b226aa-7dd7-11df-a596-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{05b226aa-7dd7-11df-a596-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05b226aa-7dd7-11df-a596-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{05b226aa-7dd7-11df-a596-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{05b226aa-7dd7-11df-a596-00215d62b644}\ not found.
File E:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4c1b7022-bab0-11df-a59d-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4c1b7022-bab0-11df-a59d-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4c1b7022-bab0-11df-a59d-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4c1b7022-bab0-11df-a59d-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4c1b7022-bab0-11df-a59d-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4c1b7022-bab0-11df-a59d-00215d62b644}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4c1b7023-bab0-11df-a59d-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4c1b7023-bab0-11df-a59d-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4c1b7023-bab0-11df-a59d-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4c1b7023-bab0-11df-a59d-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4c1b7023-bab0-11df-a59d-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4c1b7023-bab0-11df-a59d-00215d62b644}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5356705a-b374-11df-a597-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5356705a-b374-11df-a597-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5356705a-b374-11df-a597-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5356705a-b374-11df-a597-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5356705a-b374-11df-a597-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5356705a-b374-11df-a597-00215d62b644}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5356705d-b374-11df-a597-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5356705d-b374-11df-a597-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5356705d-b374-11df-a597-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5356705d-b374-11df-a597-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5356705d-b374-11df-a597-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5356705d-b374-11df-a597-00215d62b644}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9b0280bc-bee8-11e0-a625-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9b0280bc-bee8-11e0-a625-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9b0280bc-bee8-11e0-a625-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9b0280bc-bee8-11e0-a625-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9b0280bc-bee8-11e0-a625-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9b0280bc-bee8-11e0-a625-00215d62b644}\ not found.
File G:\.\Autorun.exe AUTORUN=1 not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9b0280be-bee8-11e0-a625-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9b0280be-bee8-11e0-a625-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9b0280be-bee8-11e0-a625-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9b0280be-bee8-11e0-a625-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9b0280be-bee8-11e0-a625-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9b0280be-bee8-11e0-a625-00215d62b644}\ not found.
File E:\.\Autorun.exe AUTORUN=1 not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{aa1811a6-20d8-11e0-a5d2-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aa1811a6-20d8-11e0-a5d2-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{aa1811a6-20d8-11e0-a5d2-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aa1811a6-20d8-11e0-a5d2-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{aa1811a6-20d8-11e0-a5d2-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{aa1811a6-20d8-11e0-a5d2-00215d62b644}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e09951a6-cbf9-11df-a5a7-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e09951a6-cbf9-11df-a5a7-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e09951a6-cbf9-11df-a5a7-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e09951a6-cbf9-11df-a5a7-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e09951a6-cbf9-11df-a5a7-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e09951a6-cbf9-11df-a5a7-00215d62b644}\ not found.
File E:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e09951a7-cbf9-11df-a5a7-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e09951a7-cbf9-11df-a5a7-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e09951a7-cbf9-11df-a5a7-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e09951a7-cbf9-11df-a5a7-00215d62b644}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e09951a7-cbf9-11df-a5a7-00215d62b644}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e09951a7-cbf9-11df-a5a7-00215d62b644}\ not found.
File E:\AutoRun.exe not found.
File C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\rdiut6i6d.exe not found.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\dwlGina3.dll moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Lokale Einstellungen\Anwendungsdaten\gemacasherdec3.exe moved successfully.
File C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\adfshare34.exe not found.
File C:\Dokumente und Einstellungen\jgonzalez\Lokale Einstellungen\Anwendungsdaten\winvv.exe not found.
File C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\ftuftu56.exe not found.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\.# folder moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\PriceGong\Data folder moved successfully.
C:\Dokumente und Einstellungen\jgonzalez\Anwendungsdaten\PriceGong folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 4767237 bytes
->Temporary Internet Files folder emptied: 523844 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 10196819 bytes
->Flash cache emptied: 434 bytes

User: All Users

User: Default User
->Temp folder emptied: 16384 bytes
->Temporary Internet Files folder emptied: 163974 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 10196819 bytes
->Flash cache emptied: 434 bytes

User: jgonzalez
->Temp folder emptied: 425355428 bytes
->Temporary Internet Files folder emptied: 56615893 bytes
->Java cache emptied: 1273881 bytes
->FireFox cache emptied: 113836442 bytes
->Google Chrome cache emptied: 14056576 bytes
->Flash cache emptied: 16627 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 34159 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2352202 bytes
%systemroot%\System32 .tmp files removed: 2951 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 26319643 bytes

Total Files Cleaned = 635.00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTLPE by OldTimer - Version 3.1.48.0 log created on 11172011_183632

Files\Folders moved on Reboot...
File\Folder X:\AUTORUN.INF not found!

Registry entries deleted on Reboot...



Vielen Dank für die Hilfe, echt top
Gruß
J

cosinus 22.11.2011 17:31
Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg


Falls du durch die Infektion auf deine Dokumente/Eigenen Dateien nicht zugreifen kannst, Verknüpfungen auf dem Desktop oder im Startmenü unter "alle Programme" fehlen, bitte unhide ausführen:
Downloade dir bitte unhide.exe und speichere diese Datei auf deinem Desktop.
Starte das Tool und es sollten alle Dateien und Ordner wieder sichtbar sein. ( Könnte eine Weile dauern )
http://www.trojaner-board.de/images/icons/icon4.gif Windows-Vista und Windows-7-User müssen das Tool per Rechtsklick als Administrator ausführen! http://www.trojaner-board.de/images/icons/icon4.gif


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:49 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27