| |
| |||||||
Log-Analyse und Auswertung: Bundespolizei-Schaedling!Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
03.11.2011, 16:12
| #1 |
 |  Bundespolizei-Schaedling! Hallo liebe Forumsgemeinde! Ich bin neu hier und habe mich schon belesen. Folgendes: Ich habe hier einen Rechner eines guten Bekannten, bei dem der "Bundespolizei - Schädling" auf dem Rechner ist! Mit dem Computer kann man folglich nicht mehr arbeiten, da der komplette Desktop durch die fingierte Warnmeldung gesperrt ist! Ich hoffe Ihr koennt mir helfen:heulen Bereits unternommene Maßnahmen: 2 komplette Durchläufe mit Kaspersky Rescue Disk 10 (upgedatet) - ohne Erfolg 1 Scan mit OTL - Live-CD... Hier die Logfile: OTL logfile created on: 11/3/2011 7:00:19 PM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE Microsoft Windows XP Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 88.00% Memory free 2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 149.05 Gb Total Space | 118.00 Gb Free Space | 79.17% Space Free | Partition Type: NTFS Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet003 ========== Win32 Services (SafeList) ========== SRV - [2011/06/17 09:30:26 | 000,072,464 | ---- | M] (SANDBOXIE L.T.D) [Auto] -- C:\Programme\Sandboxie\SbieSvc.exe -- (SbieSvc) SRV - [2008/11/25 07:59:28 | 000,164,097 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir Workstation\avmailc.exe -- (AntiVirMailService) SRV - [2008/11/03 20:06:28 | 000,441,712 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2008/10/24 09:30:12 | 000,068,865 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir Workstation\sched.exe -- (AntiVirScheduler) SRV - [2008/10/24 09:30:08 | 000,151,297 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir Workstation\avguard.exe -- (AntiVirService) SRV - [2008/08/29 04:00:30 | 000,033,752 | ---- | M] (NOS Microsystems Ltd.) [On_Demand] -- C:\Programme\NOS\bin\getPlus_HelperSvc.exe -- (getPlus(R) Helper) getPlus(R) SRV - [2008/06/12 08:59:46 | 000,258,305 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir Workstation\AVWEBGRD.EXE -- (antivirwebservice) SRV - [2008/05/09 07:22:40 | 000,041,217 | ---- | M] (Avira GmbH) [Auto] -- C:\Programme\Avira\AntiVir Workstation\avesvc.exe -- (AVEService) SRV - [2007/08/23 11:40:48 | 000,079,136 | ---- | M] (Hewlett-Packard Company) [Auto] -- C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe -- (LightScribeService) SRV - [2007/06/27 13:04:00 | 000,279,848 | ---- | M] (Nero AG) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - [2007/06/25 02:47:12 | 001,552,680 | ---- | M] (Nero AG) [Auto] -- C:\Programme\Nero\Nero 7\InCD\InCDsrv.exe -- (InCDsrv) SRV - [2006/10/26 08:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand] -- -- (WDICA) DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP) DRV - File not found [Kernel | System] -- -- (PCIDump) DRV - File not found [Kernel | System] -- -- (lbrtfdc) DRV - File not found [Kernel | System] -- -- (i2omgmt) DRV - File not found [Kernel | System] -- -- (Changer) DRV - [2011/06/17 09:30:20 | 000,128,272 | ---- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand] -- C:\Programme\Sandboxie\SbieDrv.sys -- (SbieDrv) DRV - [2011/01/14 09:06:40 | 000,277,352 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp) DRV - [2009/05/28 00:44:45 | 000,075,096 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2009/05/28 00:44:35 | 000,052,056 | ---- | M] (Avira GmbH) [File_System | On_Demand] -- C:\Programme\Avira\AntiVir Workstation\avgntflt.sys -- (avgntflt) DRV - [2009/05/28 00:44:33 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Programme\Avira\AntiVir Workstation\avgio.sys -- (avgio) DRV - [2008/09/09 12:07:36 | 004,813,824 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2007/11/08 13:03:26 | 000,021,248 | ---- | M] (AVIRA GmbH) [Kernel | System] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2007/06/25 02:47:12 | 000,038,440 | ---- | M] (Nero AG) [Kernel | System] -- C:\WINDOWS\system32\drivers\InCDRm.sys -- (incdrm) DRV - [2007/06/25 02:47:12 | 000,036,776 | ---- | M] (Nero AG) [Kernel | System] -- C:\WINDOWS\system32\drivers\InCDPass.sys -- (InCDPass) DRV - [2007/06/25 02:47:12 | 000,016,040 | ---- | M] (Nero AG) [Recognizer | System] -- C:\WINDOWS\System32\drivers\InCDrec.sys -- (InCDrec) DRV - [2007/06/25 02:47:02 | 000,119,080 | ---- | M] (Nero AG) [File_System | Disabled] -- C:\WINDOWS\system32\drivers\InCDfs.sys -- (InCDfs) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\USER_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\USER_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Yahoo" FF - prefs.js..browser.search.defaulturl: "hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=" FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff-" FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff-" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/" FF - prefs.js..keyword.URL: "hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011/09/08 03:40:43 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0.2\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011/06/19 11:05:26 | 000,000,000 | ---D | M] [2008/10/22 09:25:33 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\mozilla\Extensions [2011/10/25 05:49:13 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\mozilla\Firefox\Profiles\rd7trppe.default\extensions [2009/09/03 01:03:27 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\mozilla\Firefox\Profiles\rd7trppe.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011/10/25 05:49:13 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\mozilla\Firefox\Profiles\rd7trppe.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2011/06/19 10:59:53 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010/06/18 01:22:50 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010/08/23 08:59:56 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010/11/09 13:02:07 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011/01/13 08:06:57 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} File not found (No name found) -- [2008/10/23 03:54:03 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011/09/08 03:40:42 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2010/11/12 13:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll [2011/06/19 11:05:21 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2011/06/19 11:05:21 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2011/06/19 11:05:21 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2011/06/19 11:05:21 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2011/06/19 11:05:21 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2011/06/19 11:05:21 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml Hosts file not found O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Workstation\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [InCD] C:\Programme\Nero\Nero 7\InCD\InCD.exe (Nero AG) O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [SecurDisc] C:\Programme\Nero\Nero 7\InCD\NBHGui.exe (Nero AG) O4 - HKU\.DEFAULT..\Run: [8DDYX0ZBPZ] File not found O4 - HKU\USER_ON_C..\Run: [4E3E0230AEBB4E96] File not found O4 - HKU\USER_ON_C..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKU\USER_ON_C..\Run: [SandboxieControl] C:\Programme\Sandboxie\SbieCtrl.exe (SANDBOXIE L.T.D) O4 - HKU\Administrator.NAME-B060D05CFD_ON_C..\RunOnce: [NeroHomeFirstStart] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMFirstStart.exe (Nero AG) O4 - HKU\Administrator_ON_C..\RunOnce: [NeroHomeFirstStart] C:\Programme\Gemeinsame Dateien\Ahead\Lib\NMFirstStart.exe (Nero AG) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Administrator.NAME-B060D05CFD_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\USER_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - File not found O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab (get_atlcom Class) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Foundstone Inc.) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Grüne Idylle.bmp O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Programme\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008/09/22 10:19:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O36 - AppCertDlls: ntkrdt32 - (C:\WINDOWS\system32\logmsmui.dll) - File not found O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011/11/02 23:13:12 | 009,852,544 | ---- | C] (Malwarebytes Corporation ) -- C:\mbam-setup-1.51.2.1300.exe [2011/11/02 23:09:36 | 000,000,000 | ---D | C] -- C:\_OTL [1996/11/17 18:00:00 | 000,018,944 | ---- | C] ( ) -- C:\WINDOWS\System32\IMPLODE.DLL ========== Files - Modified Within 30 Days ========== [2011/11/03 12:20:49 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011/11/03 12:20:00 | 000,000,252 | -H-- | M] () -- C:\WINDOWS\tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job [2011/11/03 12:18:39 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011/11/03 12:18:24 | 000,000,252 | -H-- | M] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job [2011/11/03 12:18:23 | 000,000,252 | -H-- | M] () -- C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job [2011/11/02 23:13:15 | 009,852,544 | ---- | M] (Malwarebytes Corporation ) -- C:\mbam-setup-1.51.2.1300.exe [2011/10/30 05:16:18 | 000,487,584 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2011/10/30 05:16:18 | 000,444,456 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2011/10/30 05:16:18 | 000,095,570 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2011/10/30 05:16:18 | 000,072,332 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2011/10/28 03:30:08 | 000,000,732 | ---- | M] () -- C:\WINDOWS\ODBC.INI [2011/10/14 02:54:09 | 000,266,208 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011/10/14 02:12:40 | 000,000,118 | ---- | M] () -- C:\WINDOWS\System32\MRT.INI [2011/10/14 02:10:54 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK ========== Files Created - No Company Name ========== [2011/10/20 06:57:48 | 001,018,775 | ---- | C] () -- C:\Dokumente und Einstellungen\USER\Eigene Dateien\CIMG2008.JPG [2011/10/14 02:12:40 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI [2011/07/29 08:55:22 | 000,001,240 | ---- | C] () -- C:\WINDOWS\Sandboxie.ini [2011/07/29 06:44:27 | 000,081,936 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll [2010/12/06 16:09:09 | 000,230,440 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat [2010/04/21 03:42:41 | 000,000,016 | ---- | C] () -- C:\Dokumente und Einstellungen\NetworkService\Anwendungsdaten\kcmdte.dat [2010/04/21 03:42:39 | 000,000,004 | ---- | C] () -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\avdrn.dat [2008/10/28 11:44:42 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008/10/28 11:44:39 | 000,032,256 | ---- | C] () -- C:\Dokumente und Einstellungen\USER\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008/10/22 09:31:31 | 000,000,732 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2008/10/22 09:26:44 | 000,015,602 | ---- | C] () -- C:\WINDOWS\System32\SELF32.INI [2008/10/22 09:26:43 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\cmll10sx.dll [2008/10/22 09:26:38 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\LicenseDLL.dll [2008/10/22 09:26:38 | 000,063,488 | ---- | C] () -- C:\WINDOWS\System32\EZTW32.DLL [2008/10/22 09:26:38 | 000,061,952 | ---- | C] () -- C:\WINDOWS\System32\QFNDUW32.DLL [2008/10/22 09:26:38 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\MouseHook.dll [2008/10/22 09:26:38 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\QFW32HMB.dll [2008/10/22 09:25:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2008/09/22 11:43:01 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2008/09/22 11:14:21 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2008/09/22 11:13:45 | 000,266,208 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2008/09/22 11:08:27 | 000,002,480 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2008/09/22 11:08:19 | 000,487,584 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2008/09/22 11:08:19 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2008/09/22 11:08:19 | 000,095,570 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2008/09/22 11:08:19 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2008/09/22 11:08:09 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2008/09/22 11:08:06 | 000,444,456 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2008/09/22 11:08:06 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2008/09/22 11:08:06 | 000,072,332 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2008/09/22 11:08:06 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2008/09/22 11:08:05 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2008/09/22 11:08:05 | 000,004,518 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2008/09/22 11:08:03 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2008/09/22 11:08:02 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2008/09/22 11:08:01 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2008/09/22 11:07:58 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2008/09/22 11:07:55 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin [2008/09/22 10:45:36 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4935.dll [2008/09/22 10:29:34 | 000,000,146 | ---- | C] () -- C:\Dokumente und Einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat [2008/09/22 10:26:46 | 000,000,849 | ---- | C] () -- C:\WINDOWS\orun32.ini [2008/09/22 10:20:51 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2008/09/22 10:17:55 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2008/05/26 16:23:36 | 000,016,834 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini [2008/05/26 16:23:34 | 000,024,188 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini [2008/05/26 16:23:32 | 000,016,568 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini [2008/05/26 15:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin [2008/05/26 15:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin [2001/11/28 04:08:40 | 000,029,378 | ---- | C] () -- C:\WINDOWS\System32\pkunzip.exe [2000/04/25 07:58:08 | 000,046,592 | ---- | C] () -- C:\WINDOWS\System32\Wrkgadm.exe [1996/11/17 18:00:00 | 000,748,160 | ---- | C] () -- C:\WINDOWS\System32\CO2C40EN.DLL [1996/11/17 18:00:00 | 000,124,256 | ---- | C] () -- C:\WINDOWS\System32\U2DMAPI.DLL [1996/11/17 18:00:00 | 000,109,568 | ---- | C] () -- C:\WINDOWS\System32\U2FHTML.DLL [1996/11/17 18:00:00 | 000,097,489 | ---- | C] () -- C:\WINDOWS\System32\U2FCR.DLL [1996/11/17 18:00:00 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\U2FWKS.DLL [1996/11/17 18:00:00 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\U2FTEXT.DLL [1996/11/17 18:00:00 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\U2FSEPV.DLL [1996/11/17 18:00:00 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\U2FREC.DLL [1996/11/17 18:00:00 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\U2FDIF.DLL [1996/11/17 18:00:00 | 000,039,936 | ---- | C] () -- C:\WINDOWS\System32\CRXLAT32.DLL ========== LOP Check ========== [2008/09/30 10:28:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator.NAME-B060D05CFD\Anwendungsdaten\Windows Desktop Search [2008/09/22 10:42:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Windows Desktop Search [2011/03/01 05:43:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\TeamViewer [2008/09/30 10:28:22 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\Windows Desktop Search [2008/10/28 11:43:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\USER\Anwendungsdaten\Windows Search [2009/07/14 10:41:39 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\LightScribe [2011/11/03 12:18:24 | 000,000,252 | -H-- | M] () -- C:\WINDOWS\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job [2011/11/03 12:20:00 | 000,000,252 | -H-- | M] () -- C:\WINDOWS\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job [2011/11/03 12:18:23 | 000,000,252 | -H-- | M] () -- C:\WINDOWS\Tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job ========== Purity Check ========== < End of report > |
| Themen zu Bundespolizei-Schaedling! |
| .dll, 0x00000001, administrator, antivir, avira, bho, computer, einstellungen, explorer, firefox, fontcache, format, gesperrt, kaspersky, logfile, malwarebytes, maßnahme, neu, object, plug-in, realtek, registry, scan, sched.exe, schädling, software, windows, windows xp, winlogon, yahoo |
Baum-Darstellung