Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Gesperrter PC vom Bundesamt (https://www.trojaner-board.de/135847-gesperrter-pc-bundesamt.html)

hfrank 31.05.2013 10:09
Gesperrter PC vom Bundesamt
 
Hallo und guten Tag,

ich habe mir ein Trojaner oder ähnliches eingefangen. Das Bundesamt hat meinen PC Windows 7
32 Bit gesperrt. Habe keinen Zugriff mehr. Taskmanager sowie abgesicherter Modus geht auch nicht. Was genau für ein Virus kann ich nicht sagen.
Was muss ich machen? Was ich nicht mehr mache weiß ich schon.:headbang:


Für schnelle Hilfe bin ich dankbar. Nun wer ist das nicht was??

Gruß hfrank

markusg 31.05.2013 10:11
Hi,
kommst du an nen pc mit brenner?
download:
http://filepony.de/download-otlpe/
und brenne es mit ISOBurner auf eine CD.
ISO Burner - Download - Filepony
isoburner anleitung:
http://www.trojaner-board.de/83208-b...ei-cd-dvd.html
• Wenn der Download fertig ist mache ein doppel Klick auf die OTLPENet.exe, was ISOBurner öffnet um es auf die CD zu brennen.
Starte dein System neu und boote von der CD die du gerade erstellt hast.
Wenn du nicht weist wie du deinen Computer dazu bringst von der CD zu booten,
http://www.trojaner-board.de/81857-c...cd-booten.html

• Dein System sollte jetzt einen REATOGO-X-PE Desktop anzeigen.
• Mache einen doppel Klick auf das OTLPE Icon.
• Wenn du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
• Wenn du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
• entferne den haken bei "Automatically Load All Remaining Users" wenn er gesetzt ist.

• OTL sollte nun starten.
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg
Textbox.
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
• Drücke Run Scan um den Scan zu starten.
• Wenn er fertig ist werden die Dateien in C:\otl.txt gesichert
• Kopiere diesen Ordner auf deinen USB-Stick wenn du keine Internetverbindung auf diesem System hast.
poste beide logs

hfrank 31.05.2013 16:42
Hat bis zur Stelle "Doppelklick auf OTLPE Icon" da steht My Computer sowie eine Reihe Laufwerke und ich werde nicht gefragt.
Drücke ich auf "OK" kommt folgende Meldung RunScanner No windows installtions found.


??

markusg 31.05.2013 16:47
alles aufklappen, ordner Windows bzw wind anklicken und ab gehts

hfrank 31.05.2013 17:45
Danke für die schnelle Antwort, aber

habe bei OTL PE Version auf Run scan gedrückt richtig?
Dann öffnete sich das Notepd aber nicht mit den Codes wie hier abgebildet überhaupt nicht ähnlich. Sondern OTL logfile created:....
Windows 7 Home.......
und und
dann SRV-File not found und ca. 25 mal SRV
dann DRV
dann IE-HKU\NAme_ON
....
...
letzte Zeile
2013/04/04 Zeit ......... [M]()--C\Windows\Task\Schedlgu.TXT
Das soll alles ins Fenster reinkopiert werden ???

OTL Logfile:
Code:
OTL logfile created on: 5/31/2013 8:27:03 PM - Run
OTLPE by OldTimer - Version 3.1.48.0    Folder = X:\Programs\OTLPE
Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 100.02 Gb Total Space | 2.74 Gb Free Space | 2.74% Space Free | Partition Type: NTFS
Drive G: | 49.02 Gb Total Space | 32.18 Gb Free Space | 65.64% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet001
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto] --  -- (Adobe Version Cue CS2)
SRV - [2013/05/30 16:43:40 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/05/11 06:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013/02/25 18:22:34 | 001,260,320 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2013/01/18 02:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012/11/09 07:21:16 | 000,160,944 | R--- | M] (Skype Technologies) [Auto] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012/09/24 03:20:14 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012/05/08 13:18:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012/05/08 13:18:34 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/06/17 03:33:46 | 000,295,192 | ---- | M] (Logitech, Inc.) [On_Demand] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2010/11/23 12:33:22 | 000,240,112 | ---- | M] (CyberLink) [Auto] -- C:\Program Files\CyberLink\PowerDVD9\NavFilter\kmsvc.exe -- (CLKMSVC10_E92D8507)
SRV - [2009/07/13 21:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/13 21:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/10/08 19:19:22 | 000,358,936 | R--- | M] (Intel Corporation) [Auto] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2007/06/27 05:18:08 | 000,223,448 | ---- | M] (Intel(R) Corporation) [Auto] -- C:\Program Files\Intel\IntelDH\CCU\AlertService.exe -- (AlertService) Intel(R)
SRV - [2007/06/27 05:17:26 | 000,272,600 | ---- | M] (Intel(R) Corporation) [Auto] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\qualitymanager.exe -- (QualityManager) Intel(R)
SRV - [2007/06/27 05:17:12 | 000,446,680 | ---- | M] (Intel(R) Corporation) [Auto] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe -- (Remote UI Service) Intel(R)
SRV - [2007/06/27 05:16:02 | 000,157,912 | ---- | M] (Intel(R) Corporation) [Auto] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe -- (MCLServiceATL) Intel(R)
SRV - [2007/06/27 05:15:28 | 000,039,640 | ---- | M] (Intel(R) Corporation) [On_Demand] -- C:\Program Files\Common Files\Intel\IntelDH\bin\DHTraceController.exe -- (DHTRACE) Intel(R)
SRV - [2007/06/27 05:15:14 | 000,059,096 | ---- | M] (Intel(R) Corporation) [Auto] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe -- (ISSM) Intel(R)
SRV - [2007/06/27 05:14:46 | 000,317,656 | ---- | M] (Intel(R) Corporation) [Auto] -- C:\Program Files\Common Files\Intel\IntelDH\NMS\NMSCore\NMSCore.exe -- (NMSCore) Intel(R)
SRV - [2007/06/27 05:13:56 | 000,268,504 | ---- | M] () [Auto] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe -- (M1 Server) Intel(R) Viiv(TM)
SRV - [2007/02/12 06:46:34 | 000,208,896 | ---- | M] () [Auto] -- C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe -- (DQLWinService)
SRV - [2001/11/12 08:31:48 | 000,020,480 | ---- | M] (X10) [Auto] -- C:\Program Files\Common Files\X10\Common\X10nets.exe -- (x10nets)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | System] --  -- (StarRAM)
DRV - [2013/02/25 18:22:06 | 008,939,296 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2013/02/06 02:42:10 | 000,083,864 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV - [2012/05/08 13:18:34 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2012/05/08 13:18:34 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2012/02/15 18:24:36 | 000,181,432 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)
DRV - [2011/09/15 17:55:04 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)
DRV - [2011/04/30 08:00:20 | 000,030,360 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2011/04/30 08:00:18 | 000,039,064 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2011/04/30 08:00:06 | 000,041,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2011/04/30 07:59:44 | 000,022,040 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\L8042Kbd.sys -- (L8042Kbd)
DRV - [2010/11/20 06:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 05:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/06/17 09:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/06/09 09:08:49 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2009/07/13 19:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009/07/13 18:54:15 | 001,311,232 | ---- | M] (NXP Semiconductors) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Ph3xIB32.sys -- (Ph3xIB32)
DRV - [2009/07/13 18:02:53 | 000,657,408 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\netr28u.sys -- (netr28u)
DRV - [2009/07/13 18:02:50 | 000,211,456 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2007/06/29 08:47:34 | 000,034,304 | ---- | M] (AMD, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\AmdLLD.sys -- (AmdLLD)
DRV - [2007/06/27 05:17:46 | 000,014,552 | ---- | M] () [File_System | On_Demand] -- C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.sys -- (TSHWMDTCP)
DRV - [2007/02/18 15:34:50 | 000,005,376 | --S- | M] (Gteko Ltd.) [Kernel | Auto] -- C:\Windows\System32\drivers\nmsunidr.sys -- (nmsunidr)
DRV - [2006/11/30 10:18:18 | 000,027,416 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\x10ufx2.sys -- (XUIF)
DRV - [2006/11/17 05:31:04 | 000,013,976 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\x10hid.sys -- (X10Hid)
DRV - [2005/03/15 12:04:00 | 000,161,792 | ---- | M] (OmniVision Technologies, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ov530vid.sys -- (ovt530)
DRV - [2004/05/02 04:47:08 | 000,023,040 | R--- | M] () [Kernel | On_Demand] -- C:\Windows\System32\drivers\GVCplDrv.sys -- (GVCplDrv)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} -  File not found
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\HPF_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKU\HPF_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\HPF_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.inbox.com/homepage.aspx?tbid=80752&lng=de
IE - HKU\HPF_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\HPF_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\HPF_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = BE 0C DD 03 D0 A7 CC 01  [binary data]
IE - HKU\HPF_ON_C\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKU\HPF_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\HPF_ON_C\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\HPF_ON_C\..\URLSearchHook: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
IE - HKU\HPF_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\Max_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\Max_ON_C\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} -  File not found
IE - HKU\Max_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\PF_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\PF_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\PF_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\PF_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
 
 
========== FireFox ==========
 
FF - prefs.js..CT2883880browser.search.defaultthis.engineName: true
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://news.google.de/nwshp?client=firefox-a&rls=org.mozilla:de:official&hl=de&tab=wn"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {2E6861CA-9A88-4B7B-B935-F810DE84D259}:1.0.2.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:3.0.1
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.13
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\System32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0:  File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\System32\npdeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@logitech.com/HarmonyRemote,version=1.0.0: C:\Program Files\Logitech\Harmony Remote Driver\NprtHarmonyPlugin.dll (Logitech Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\HPF\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\HPF\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files\Siber Systems\AI RoboForm\Firefox [2013/05/30 04:35:48 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Users\HPF\AppData\Local\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Users\HPF\AppData\Local\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/05/30 16:43:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0\extensions\\Components: D:\Program Files\Mozilla Thunderbird\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 12.0\extensions\\Plugins: D:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.6\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013/05/16 04:55:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.6\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013/05/30 16:43:38 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.6\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013/05/16 04:55:00 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.6\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
 
[2011/10/10 16:59:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\HPF\AppData\Roaming\Mozilla\Extensions
[2011/10/10 16:59:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\HPF\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2013/05/30 14:03:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\HPF\AppData\Roaming\Mozilla\Firefox\Profiles\bl5xkh4q.default\extensions
[2013/02/26 18:28:43 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Users\HPF\AppData\Roaming\Mozilla\Firefox\Profiles\bl5xkh4q.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2013/05/30 14:03:16 | 000,000,000 | ---D | M] (Abacho) -- C:\Users\HPF\AppData\Roaming\Mozilla\Firefox\Profiles\bl5xkh4q.default\extensions\{ba23315d-608c-4984-b402-3438dcfc5b82}
[2013/04/19 05:33:57 | 000,000,000 | ---D | M] (AppGraffiti) -- C:\Users\HPF\AppData\Roaming\Mozilla\Firefox\Profiles\bl5xkh4q.default\extensions\AppGraffiti@AppGraffiti.com
[2013/04/20 17:48:41 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\HPF\AppData\Roaming\Mozilla\Firefox\Profiles\bl5xkh4q.default\extensions\toolbar@ask.com
[2013/04/19 05:34:06 | 000,001,050 | ---- | M] () -- C:\Users\HPF\AppData\Roaming\Mozilla\Firefox\Profiles\bl5xkh4q.default\searchplugins\11-suche.xml
[2013/04/20 17:48:40 | 000,002,308 | ---- | M] () -- C:\Users\HPF\AppData\Roaming\Mozilla\Firefox\Profiles\bl5xkh4q.default\searchplugins\askcom.xml
[2011/11/27 06:52:34 | 000,000,905 | ---- | M] () -- C:\Users\HPF\AppData\Roaming\Mozilla\Firefox\Profiles\bl5xkh4q.default\searchplugins\conduit.xml
[2013/04/19 05:34:06 | 000,002,418 | ---- | M] () -- C:\Users\HPF\AppData\Roaming\Mozilla\Firefox\Profiles\bl5xkh4q.default\searchplugins\englische-ergebnisse.xml
[2013/04/19 05:34:06 | 000,010,701 | ---- | M] () -- C:\Users\HPF\AppData\Roaming\Mozilla\Firefox\Profiles\bl5xkh4q.default\searchplugins\gmx-suche.xml
[2013/04/19 05:34:06 | 000,002,432 | ---- | M] () -- C:\Users\HPF\AppData\Roaming\Mozilla\Firefox\Profiles\bl5xkh4q.default\searchplugins\lastminute.xml
[2013/04/19 05:34:06 | 000,005,682 | ---- | M] () -- C:\Users\HPF\AppData\Roaming\Mozilla\Firefox\Profiles\bl5xkh4q.default\searchplugins\webde-suche.xml
[2013/05/30 16:43:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013/05/30 16:43:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{2E6861CA-9A88-4B7B-B935-F810DE84D259}
[2013/05/30 16:43:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/05/30 16:43:37 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/05/30 16:43:41 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\distribution\extensions
[2013/05/30 16:43:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\distribution\extensions
File not found (No name found) --
() (No name found) -- C:\USERS\HPF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BL5XKH4Q.DEFAULT\EXTENSIONS\{3335F91D-2AEF-4097-B831-C96C60349822}.XPI
() (No name found) -- C:\USERS\HPF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BL5XKH4Q.DEFAULT\EXTENSIONS\{9AA46F4F-4DC7-4C06-97AF-5035170634FE}.XPI
() (No name found) -- C:\USERS\HPF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BL5XKH4Q.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}.XPI
() (No name found) -- C:\USERS\HPF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BL5XKH4Q.DEFAULT\EXTENSIONS\{EF4E370E-D9F0-4E00-B93E-A4F274CFDD5A}.XPI
() (No name found) -- C:\USERS\HPF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BL5XKH4Q.DEFAULT\EXTENSIONS\CK@EVERYGAIN.COM.XPI
() (No name found) -- C:\USERS\HPF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BL5XKH4Q.DEFAULT\EXTENSIONS\TESTPILOT@LABS.MOZILLA.COM.XPI
() (No name found) -- C:\USERS\HPF\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\BL5XKH4Q.DEFAULT\EXTENSIONS\TRANSLATOR@ZOLI.BOD.XPI
[2010/05/15 09:03:56 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
 
O1 HOSTS File: ([2006/09/18 17:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (AppGraffiti) - {6F6A5334-78E9-4D9B-8182-8B41EA8C39EF} - C:\Program Files\AppGraffiti\AppGraffiti.dll (Omega Partners Ltd)
O2 - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} -  File not found
O2 - BHO: (Inbox Toolbar) - {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (&RoboForm Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} -  File not found
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (&Inbox Toolbar) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O3 - HKU\HPF_ON_C\..\Toolbar\WebBrowser: (&RoboForm Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O3 - HKU\HPF_ON_C\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} -  File not found
O3 - HKU\Max_ON_C\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} -  File not found
O3 - HKU\PF_ON_C\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKU\PF_ON_C\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} -  File not found
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ActiveSpeed] C:\Program Files\Ascentive\ActiveSpeed\AS.exe (Ascentive LLC)
O4 - HKLM..\Run: [Adobe Version Cue CS2]  File not found
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [BDRegion] C:\Program Files\CyberLink\Shared files\brs.exe (cyberlink)
O4 - HKLM..\Run: [CCUTRAYICON] C:\Program Files\Intel\IntelDH\CCU\CCU_TrayIcon.exe (Intel(R) Corporation)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [InboxToolbar] C:\Program Files\Inbox Toolbar\Inbox.exe (Inbox.com, Inc.)
O4 - HKLM..\Run: [MDS_Menu] C:\Program Files\CyberLink\MediaShow4\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [NMSSupport] C:\Program Files\Common Files\Intel\IntelDH\NMS\Support\IntelHCTAgent.exe (Intel Corporation)
O4 - HKLM..\Run: [QuickTime Task]  File not found
O4 - HKLM..\Run: [RemoteControl9] C:\Program Files\CyberLink\PowerDVD9\PDVD9Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKU\HPF_ON_C..\Run: [QuickTime Task]  File not found
O4 - HKU\HPF_ON_C..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKU\Max_ON_C..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\Max_ON_C..\Run: [EA Core]  File not found
O4 - HKU\PF_ON_C..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKU\PF_ON_C..\Run: [RoboForm] C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe (Siber Systems)
O4 - HKU\IUSR_NMPR_ON_C..\RunOnce: [DPAPIKeyMig] C:\Windows\System32\dpapimig.exe (Microsoft Corporation)
O4 - HKU\IUSR_NMPR_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\IUSR_NMPR_ON_C..\RunOnce: [WAB Migrate] C:\Program Files\Windows Mail\wab.exe (Microsoft Corporation)
O4 - HKU\LocalService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\PF_ON_C..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil9f.exe (Adobe Systems, Inc.)
O4 - HKU\UpdatusUser_ON_C..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - Startup: C:\Users\HPF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ()
O4 - Startup: C:\Users\HPF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk ()
O4 - Startup: C:\Users\Max\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\HPF_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: RF - Formular ausfüllen - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html ()
O8 - Extra context menu item: RF - Formular speichern - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html ()
O8 - Extra context menu item: RF - Menü anpassen - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html ()
O8 - Extra context menu item: RF - RoboForm-Leiste ein/aus - C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html ()
O9 - Extra Button: Ausfüllen - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : RF - Formular ausfüllen - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Speichern - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : RF - Formular speichern - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Symbolleiste anzeigen - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : RF - RoboForm-Leiste ein/aus - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 1.6.0_35)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab (Java Plug-in 10.21.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\inbox {37540F19-DD4C-478B-B2DF-C19281BCAF27} - C:\Program Files\Inbox Toolbar\Inbox.dll (Inbox.com, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\HPF_ON_C Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKU\HPF_ON_C Winlogon: Shell - (C:\Users\HPF\AppData\Roaming\skype.dat) - C:\Users\HPF\AppData\Roaming\skype.dat ()
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{58c87a85-45dd-11e1-b021-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{58c87a85-45dd-11e1-b021-806e6f6e6963}\Shell\AutoRun\command - "" = F:\Setup.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/05/30 16:43:37 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013/05/24 09:27:23 | 000,000,000 | ---D | C] -- C:\Users\HPF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sawbuck
[2013/05/16 05:10:17 | 000,420,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2013/05/16 05:10:17 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2013/05/16 05:10:16 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2013/05/16 05:10:16 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2013/05/16 05:10:16 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2013/05/16 05:10:16 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2013/05/16 05:10:15 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2013/05/16 05:10:15 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2013/05/16 05:10:14 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2013/05/16 05:08:02 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2013/05/16 04:54:55 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird
[2013/05/16 04:02:50 | 002,347,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2013/05/16 04:02:50 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wwanprotdim.dll
[2013/05/16 03:58:37 | 000,218,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\dxgmms1.sys
[2013/05/16 03:58:35 | 001,796,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\authui.dll
[2013/05/16 03:58:35 | 000,101,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\consent.exe
[2007/02/28 08:36:56 | 000,552,214 | ---- | C] (Macrovision Corporation) -- C:\Program Files\ISSetup.dll
[2006/05/24 21:10:42 | 000,455,600 | ---- | C] (Macrovision Corporation) -- C:\Program Files\setup.exe
[2006/05/17 20:21:04 | 000,385,968 | ---- | C] (Macrovision Corporation) -- C:\Program Files\_Setup.dll
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/05/31 11:09:22 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/05/31 11:08:24 | 2615,808,000 | -HS- | M] () -- C:\hiberfil.sys
[2013/05/31 04:54:42 | 000,000,004 | ---- | M] () -- C:\Users\HPF\AppData\Roaming\skype.ini
[2013/05/31 04:53:24 | 000,001,088 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/05/31 04:03:35 | 000,019,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/31 04:03:35 | 000,019,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/31 03:56:00 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1474446695-421227543-3082741238-1005UA.job
[2013/05/31 01:33:00 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/05/30 15:56:00 | 000,001,060 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1474446695-421227543-3082741238-1005Core.job
[2013/05/30 04:35:48 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RoboForm
[2013/05/30 04:30:58 | 000,001,227 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013/05/30 04:30:58 | 000,001,197 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013/05/29 04:56:57 | 000,001,044 | ---- | M] () -- C:\Users\HPF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013/05/29 04:56:49 | 000,001,008 | ---- | M] () -- C:\Users\HPF\Desktop\Dropbox.lnk
[2013/05/27 12:16:18 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013/05/27 12:16:18 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013/05/27 12:16:18 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013/05/27 12:16:18 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013/05/27 12:00:00 | 000,000,438 | ---- | M] () -- C:\Windows\tasks\ParetoLogic Registration.job
[2013/05/24 12:59:34 | 000,002,351 | ---- | M] () -- C:\Users\HPF\Desktop\Google Chrome.lnk
[2013/05/24 06:00:33 | 000,002,353 | ---- | M] () -- C:\Users\HPF\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/05/20 06:38:05 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
[2013/05/16 15:34:33 | 000,002,441 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
[2013/05/16 15:08:16 | 000,309,448 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013/05/13 14:18:31 | 000,016,829 | ---- | M] () -- C:\Users\HPF\Documents\Abrechnung KV 05_2013.odt
[2013/05/12 13:00:02 | 000,014,263 | ---- | M] () -- C:\Users\HPF\Documents\Schreiben Krankengeldzuschuss ZBB.odt
[2013/05/10 12:37:51 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
[2013/05/05 15:12:55 | 002,382,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/05/31 02:03:28 | 000,000,004 | ---- | C] () -- C:\Users\HPF\AppData\Roaming\skype.ini
[2013/05/13 14:18:30 | 000,016,829 | ---- | C] () -- C:\Users\HPF\Documents\Abrechnung KV 05_2013.odt
[2013/05/12 12:59:39 | 000,014,263 | ---- | C] () -- C:\Users\HPF\Documents\Schreiben Krankengeldzuschuss ZBB.odt
[2013/03/05 14:06:46 | 000,007,602 | ---- | C] () -- C:\Users\HPF\AppData\Local\Resmon.ResmonCfg
[2013/01/08 19:55:06 | 000,016,384 | ---- | C] () -- C:\Windows\System32\FileOps.exe
[2012/06/30 16:53:11 | 000,159,744 | ---- | C] () -- C:\Users\HPF\AppData\Roaming\skype.dat
[2012/02/25 15:19:55 | 000,096,768 | ---- | C] () -- C:\Windows\SlantAdj.dll
[2012/02/25 15:19:55 | 000,003,136 | ---- | C] () -- C:\Windows\Ade001.bin
[2012/02/25 15:19:55 | 000,001,571 | ---- | C] () -- C:\Windows\Faxcpp1.ini
[2012/02/25 15:19:55 | 000,000,422 | ---- | C] () -- C:\Windows\Faxcpp.ini
[2012/02/25 15:19:55 | 000,000,072 | ---- | C] () -- C:\Windows\System32\epDPE.ini
[2012/02/14 15:23:56 | 000,577,536 | ---- | C] () -- C:\Windows\System32\ChilkatCsv.dll
[2011/11/23 18:30:14 | 000,000,566 | ---- | C] () -- C:\Windows\System32\SP7302.ini
[2011/11/22 19:55:01 | 000,252,928 | ---- | C] () -- C:\Windows\System32\DShowRdpFilter.dll
[2011/11/17 18:41:10 | 000,000,000 | ---- | C] () -- C:\Windows\bctester_de.INI
[2011/10/15 08:46:27 | 000,045,056 | ---- | C] () -- C:\Windows\System32\prnunins.exe
[2011/10/13 10:28:42 | 000,025,600 | ---- | C] () -- C:\Users\HPF\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/10/10 12:32:50 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011/08/25 17:26:11 | 000,099,548 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2011/05/24 02:35:48 | 000,450,560 | ---- | C] () -- C:\Windows\System32\AscSQLite.dll
[2011/04/04 11:14:58 | 000,785,408 | ---- | C] () -- C:\Program Files\ooodev34.msi
[2011/01/19 07:34:42 | 003,003,392 | ---- | C] () -- C:\Program Files\openofficeorg33.msi
[2010/07/01 09:20:40 | 000,139,152 | ---- | C] () -- C:\Users\Max\AppData\Roaming\PnkBstrK.sys
[2010/07/01 09:20:40 | 000,137,544 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2010/07/01 09:19:56 | 000,189,480 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2010/07/01 09:19:54 | 000,794,408 | ---- | C] () -- C:\Windows\System32\pbsvc.exe
[2010/07/01 09:19:54 | 000,075,064 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2010/06/14 19:00:11 | 000,000,022 | ---- | C] () -- C:\Windows\WET.INI
[2010/05/15 09:11:48 | 000,021,532 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat
[2010/05/01 10:14:42 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2010/05/01 10:14:42 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2010/05/01 10:14:42 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2010/05/01 09:41:42 | 000,035,586 | ---- | C] () -- C:\Windows\DIIUnin.dat
[2010/03/14 06:42:03 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010/03/12 18:51:53 | 000,081,713 | ---- | C] () -- C:\Windows\War3Unin.dat
[2010/03/09 13:38:25 | 000,127,184 | ---- | C] () -- C:\Windows\Unwise.exe
[2010/03/09 07:15:09 | 000,002,369 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2010/03/09 07:15:08 | 000,005,824 | ---- | C] () -- C:\Windows\System32\drivers\ASUSHWIO.SYS
[2009/11/06 04:58:04 | 000,178,975 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2009/07/14 04:47:43 | 000,653,928 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2009/07/14 04:47:43 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2009/07/14 04:47:43 | 000,129,800 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2009/07/14 04:47:43 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2009/07/14 00:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009/07/14 00:33:53 | 000,309,448 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,615,810 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,106,190 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2007/02/28 08:37:00 | 005,652,951 | ---- | C] () -- C:\Program Files\data2.cab
[2007/02/28 08:37:00 | 000,000,455 | ---- | C] () -- C:\Program Files\layout.bin
[2007/02/28 08:36:58 | 000,669,357 | ---- | C] () -- C:\Program Files\data1.cab
[2007/02/28 08:36:58 | 000,018,503 | ---- | C] () -- C:\Program Files\data1.hdr
[2007/02/28 08:36:56 | 000,000,493 | ---- | C] () -- C:\Program Files\setup.ini
[2007/02/28 08:36:54 | 000,210,312 | ---- | C] () -- C:\Program Files\setup.inx
[2006/06/23 05:09:34 | 000,019,968 | R--- | C] () -- C:\Windows\System32\cpuinf32.dll
[2004/05/02 04:47:08 | 000,023,040 | R--- | C] () -- C:\Windows\System32\drivers\GVCplDrv.sys
[1998/03/22 07:50:02 | 000,010,240 | ---- | C] () -- C:\Windows\System32\vidx16.dll
 
========== LOP Check ==========
 
[2010/07/29 12:17:20 | 000,000,000 | ---D | M] -- C:\Users\Max\AppData\Roaming\Azureus
[2011/12/23 13:34:21 | 000,000,000 | ---D | M] -- C:\Users\Max\AppData\Roaming\Bioshock2
[2010/08/06 18:20:01 | 000,000,000 | ---D | M] -- C:\Users\Max\AppData\Roaming\Builder
[2010/06/09 18:20:16 | 000,000,000 | ---D | M] -- C:\Users\Max\AppData\Roaming\DAEMON Tools Lite
[2011/11/18 15:13:39 | 000,000,000 | ---D | M] -- C:\Users\Max\AppData\Roaming\IrfanView
[2011/06/10 17:25:52 | 000,000,000 | ---D | M] -- C:\Users\Max\AppData\Roaming\Natural Selection 2
[2010/06/03 18:23:00 | 000,000,000 | ---D | M] -- C:\Users\Max\AppData\Roaming\OpenOffice.org
[2010/05/31 17:15:51 | 000,000,000 | ---D | M] -- C:\Users\Max\AppData\Roaming\SanDisk
[2011/10/10 12:32:50 | 000,000,000 | ---D | M] -- C:\Users\Max\AppData\Roaming\Thunderbird
[2010/07/04 09:59:43 | 000,000,000 | ---D | M] -- C:\Users\Max\AppData\Roaming\TS3Client
[2012/12/24 16:20:38 | 000,000,000 | ---D | M] -- C:\Users\PF\AppData\Roaming\24x7 Help
[2010/06/13 10:31:42 | 000,000,000 | ---D | M] -- C:\Users\PF\AppData\Roaming\Bioshock2
[2010/10/10 16:15:52 | 000,000,000 | ---D | M] -- C:\Users\PF\AppData\Roaming\DAEMON Tools Lite
[2011/10/11 13:16:09 | 000,000,000 | ---D | M] -- C:\Users\PF\AppData\Roaming\gsak
[2010/05/15 09:07:31 | 000,000,000 | ---D | M] -- C:\Users\PF\AppData\Roaming\Leadertech
[2010/05/15 09:07:37 | 000,000,000 | ---D | M] -- C:\Users\PF\AppData\Roaming\OpenOffice.org
[2010/05/15 09:07:38 | 000,000,000 | ---D | M] -- C:\Users\PF\AppData\Roaming\Thunderbird
[2011/06/19 16:01:27 | 000,000,000 | ---D | M] -- C:\Users\PF\AppData\Roaming\TS3Client
[2010/06/10 07:43:19 | 000,000,000 | ---D | M] -- C:\ProgramData\2DBoy
[2010/05/15 09:21:36 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data
[2013/04/19 19:11:06 | 000,000,000 | ---D | M] -- C:\ProgramData\Ask
[2010/06/06 10:38:34 | 000,000,000 | ---D | M] -- C:\ProgramData\Cached Installations
[2012/04/08 09:08:49 | 000,000,000 | ---D | M] -- C:\ProgramData\ChessBase
[2010/06/09 09:08:01 | 000,000,000 | ---D | M] -- C:\ProgramData\DAEMON Tools Lite
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents
[2010/05/15 09:21:36 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente
[2011/11/26 14:51:15 | 000,000,000 | ---D | M] -- C:\ProgramData\Driver Mender
[2010/06/10 15:17:46 | 000,000,000 | ---D | M] -- C:\ProgramData\Electronic Arts
[2013/03/05 16:19:13 | 000,000,000 | ---D | M] -- C:\ProgramData\elsterformular
[2010/05/15 09:21:36 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites
[2012/07/05 10:39:25 | 000,000,000 | ---D | M] -- C:\ProgramData\GARMIN
[2010/05/15 09:03:31 | 000,000,000 | ---D | M] -- C:\ProgramData\ICQ
[2011/11/17 19:56:27 | 000,000,000 | ---D | M] -- C:\ProgramData\IsolatedStorage
[2010/06/06 10:39:06 | 000,000,000 | ---D | M] -- C:\ProgramData\ParetoLogic
[2012/01/16 12:42:31 | 000,000,000 | ---D | M] -- C:\ProgramData\Pictomio
[2011/10/17 12:36:03 | 000,000,000 | ---D | M] -- C:\ProgramData\RoboForm
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu
[2010/05/15 09:21:36 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü
[2012/01/23 12:05:55 | 000,000,000 | ---D | M] -- C:\ProgramData\Temp
[2009/07/14 00:53:55 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates
[2010/05/15 09:21:36 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen
[2010/05/15 09:03:41 | 000,000,000 | ---D | M] -- C:\ProgramData\X10 Settings
[2010/05/15 09:03:41 | 000,000,000 | ---D | M] -- C:\ProgramData\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/05/15 09:03:41 | 000,000,000 | ---D | M] -- C:\ProgramData\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2013/05/27 12:00:00 | 000,000,438 | ---- | M] () -- C:\Windows\Tasks\ParetoLogic Registration.job
[2010/06/07 22:51:00 | 000,000,412 | ---- | M] () -- C:\Windows\Tasks\ParetoLogic Update Version2.job
[2013/04/04 16:30:45 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >
--- --- ---

markusg 31.05.2013 18:22
ne, denn die Reihenfolge sagt ja, zuerst in das fenster kopieren, dann auf scan klicken
aber belassen wirs dabei
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:
Code:
:OTL
O20 - HKU\HPF_ON_C Winlogon: Shell - (C:\Users\HPF\AppData\Roaming\skype.dat) - C:\Users\HPF\AppData\Roaming\skype.dat ()
[2013/05/31 04:54:42 | 000,000,004 | ---- | M] () -- C:\Users\HPF\AppData\Roaming\skype.ini
:Files
:Commands
[EMPTYFLASH]
[emptytemp]


dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.


falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)


b

hfrank 31.05.2013 20:12
Alles bis auf das hochladen hat super geklappt
Ich soll immer den LINK zum Thread überprüfen.?
hxxp://upload.trojaner-board.de/ das hab ich eingegeben.

Scanner ist auch aus.

markusg 31.05.2013 20:33
Code:
http://www.trojaner-board.de/135847-gesperrter-pc-bundesamt.html
das ist der link

markusg 02.06.2013 11:42
Danke fürs hochladen.
Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:57 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55