| |
| |||||||
Log-Analyse und Auswertung: Kido eingefangen und versucht zu entfernen. Ist mein Rechner jetzt sauber ?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
04.11.2011, 17:23
| #1 |
 |  Kido eingefangen und versucht zu entfernen. Ist mein Rechner jetzt sauber ? Guten Tag  Ich hatte mir gestern auf meinen USB Stick, durch die Schule, den Networm32.Kido.ir eingefangen.. Kaspersky hatte auch gleich nach dem anstecken des USB Sticks Alarm geschlagen. Es kamen einige Meldungen nach denen Kaspersky manche Dateien nicht löschen konnte. Im Bericht stand letztendlich dann aber 3 von 4 Schädliche Dateien gelöscht. Danch hab ich mir den KK (Kido Killer) runtergeladen und ausgeführt. Zuerst auf C:/ . Hatte dort nichts gefunden und da in der Konsole von KK die ganze zeit nur C:/ als Ort zum scannen stand hab ich mir gedacht der sucht nur auf C und hab KK noch mal auf meinen Stick kopiert, dort ausgeführt und auch wieder nichts gefunden.(Wobei, auch beim auf dem Stick ausführen, stand nur wieder C:/ beim scan Vorgang  )Sicher fühlte ich mich jetzt aber trotzdem noch nicht und hab dann den stick formatiert und mein Rechner neu aufgesetzt. Da ich heute wieder inner Schule war und eine Präsentation halten musste, hatte ich den Stick dort auch wieder angeschlossen und diesmal hatte sich auch dort die AntiViren Software gemeldet. Meine Fragen sind nun: 1. Ob mein Rechner so wie er jetzt ist sauber ist oder nicht und 2. Mein Stick möche ich auch gerne wieder "reinigen", wenn ich das getan hab und der meinung bin der ist wieder sauber, kann ich von dem dann auch die Logs erstellen ? Geht es hierbei wenn ich OTL und Defogger auf dem stick starte? Ich hoffe Ihr könnt mir helfen Code:
ATTFilter OTL logfile created on: 04.11.2011 16:19:37 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = D:\Benutzer\***\Desktop 64bit- Professional (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 4,00 Gb Total Physical Memory | 2,84 Gb Available Physical Memory | 71,07% Memory free 8,00 Gb Paging File | 6,78 Gb Available in Paging File | 84,82% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 60,55 Gb Total Space | 39,68 Gb Free Space | 65,54% Space Free | Partition Type: NTFS Drive D: | 405,21 Gb Total Space | 401,08 Gb Free Space | 98,98% Space Free | Partition Type: NTFS Computer Name: ***-PC | User Name: *** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.11.04 15:10:49 | 000,584,192 | ---- | M] (OldTimer Tools) -- D:\Benutzer\***\Desktop\OTL.exe PRC - [2010.05.06 09:10:22 | 000,361,120 | ---- | M] (Kaspersky Lab) -- D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\avp.exe PRC - [2009.01.08 06:33:32 | 000,024,576 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\Ctxfihlp.exe PRC - [2009.01.08 06:28:42 | 001,212,928 | ---- | M] (Creative Technology Ltd) -- C:\Windows\SysWOW64\CTxfispi.exe ========== Modules (No Company Name) ========== MOD - [2008.07.10 13:35:52 | 000,144,896 | ---- | M] () -- C:\Windows\SysWOW64\APOMngr.DLL MOD - [2007.09.13 03:05:22 | 000,002,560 | ---- | M] () -- C:\Windows\SysWOW64\CTXFIGER.DLL ========== Win32 Services (SafeList) ========== SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2011.11.03 18:37:20 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service) SRV - [2010.05.06 09:10:22 | 000,361,120 | ---- | M] (Kaspersky Lab) [Auto | Running] -- D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\avp.exe -- (AVP) SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011.11.03 17:46:57 | 000,353,296 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\SysNative\drivers\klif.sys -- (KLIF) DRV:64bit: - [2009.10.14 21:18:38 | 000,040,464 | ---- | M] (Kaspersky Lab) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\klbg.sys -- (KLBG) DRV:64bit: - [2009.10.02 19:39:32 | 000,021,008 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\klmouflt.sys -- (klmouflt) DRV:64bit: - [2009.09.14 14:46:42 | 000,027,152 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\klim6.sys -- (KLIM6) DRV:64bit: - [2009.09.01 15:29:56 | 000,157,712 | ---- | M] (Kaspersky Lab) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kl1.sys -- (kl1) DRV:64bit: - [2009.07.14 02:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2009.07.14 02:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.25 03:14:46 | 000,058,368 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\l160x64.sys -- (AtcL001) DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.01.08 08:48:20 | 001,604,632 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ha20x22k.sys -- (ha20x22k) DRV:64bit: - [2009.01.08 08:47:41 | 001,560,600 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ha20x2k.sys -- (ha20x2k) DRV:64bit: - [2009.01.08 08:47:04 | 000,118,296 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\emupia2k.sys -- (emupia) DRV:64bit: - [2009.01.08 08:46:33 | 000,213,016 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctsfm2k.sys -- (ctsfm2k) DRV:64bit: - [2009.01.08 08:46:01 | 000,015,896 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctprxy2k.sys -- (ctprxy2k) DRV:64bit: - [2009.01.08 08:45:26 | 000,179,224 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctoss2k.sys -- (ossrv) DRV:64bit: - [2009.01.08 08:44:08 | 000,695,960 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ctaud2k.sys -- (ctaud2k) Creative Audio Driver (WDM) DRV:64bit: - [2009.01.08 08:43:36 | 000,580,632 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ctac32k.sys -- (ctac32k) DRV:64bit: - [2009.01.08 08:40:52 | 001,445,912 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX.SYS) DRV:64bit: - [2009.01.08 08:40:52 | 001,445,912 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTEXFIFX.sys -- (CTEXFIFX) DRV:64bit: - [2009.01.08 08:40:11 | 000,095,256 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT.SYS) DRV:64bit: - [2009.01.08 08:40:11 | 000,095,256 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CTHWIUT.sys -- (CTHWIUT) DRV:64bit: - [2009.01.08 08:39:40 | 000,230,424 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT.SYS) DRV:64bit: - [2009.01.08 08:39:40 | 000,230,424 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CT20XUT.sys -- (CT20XUT) DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 56 0E 13 63 48 9A CC 01 [binary data] IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_0_1.dll File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: D:\Programme\Mozilla Firefox\components [2011.11.03 18:25:07 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{eea12ec4-729d-4703-bc37-106ce9879ce2}: D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\THBExt [2011.11.03 17:47:06 | 000,000,000 | ---D | M] [2011.11.03 18:25:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\x64\ievkbd.dll (Kaspersky Lab) O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\x64\klwtbbho.dll (Kaspersky Lab) O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\ievkbd.dll (Kaspersky Lab) O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\klwtbbho.dll (Kaspersky Lab) O4:64bit: - HKLM..\Run: [Eraser] D:\Programme\Eraser\Eraser.exe (The Eraser Project) O4 - HKLM..\Run: [AVP] D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\avp.exe (Kaspersky Lab) O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\SysWow64\Ctxfihlp.exe (Creative Technology Ltd) O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:64bit: - Extra context menu item: Hinzufügen zu Anti-Banner - D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\ie_banner_deny.htm () O8 - Extra context menu item: Hinzufügen zu Anti-Banner - D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\ie_banner_deny.htm () O9:64bit: - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\x64\klwtbbho.dll (Kaspersky Lab) O9:64bit: - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\x64\klwtbbho.dll (Kaspersky Lab) O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\klwtbbho.dll (Kaspersky Lab) O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\klwtbbho.dll (Kaspersky Lab) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4ECEB3EF-24A3-49E6-9170-1D6BEEA188F6}: DhcpNameServer = 192.168.178.1 O20:64bit: - AppInit_DLLs: (D:\PROGRA~1\KASPER~1\KASPER~1\x64\sbhook64.dll) - D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\x64\sbhook64.dll (Kaspersky Lab) O20:64bit: - AppInit_DLLs: (D:\PROGRA~1\KASPER~1\KASPER~1\x64\kloehk.dll) - D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\x64\kloehk.dll (Kaspersky Lab) O20 - AppInit_DLLs: (D:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) -D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\mzvkbd3.dll (Kaspersky Lab) O20 - AppInit_DLLs: (D:\PROGRA~1\KASPER~1\KASPER~1\sbhook.dll) -D:\Programme\Kaspersky Lab\Kaspersky Security Suite CBE 10\sbhook.dll (Kaspersky Lab) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\klogon: DllName - (%SystemRoot%\System32\klogon.dll) - C:\Windows\SysNative\klogon.dll (Kaspersky Lab) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.11.04 16:11:31 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Eraser 6 [2011.11.04 15:10:37 | 000,584,192 | ---- | C] (OldTimer Tools) -- D:\Benutzer\***\Desktop\OTL.exe [2011.11.04 14:51:57 | 009,183,120 | ---- | C] (The Eraser Project) -- D:\Benutzer\***\Documents\Eraser_6.0.8.2273.exe [2011.11.04 13:59:37 | 000,000,000 | ---D | C] -- D:\Benutzer\***\Documents\GUILD WARS [2011.11.03 19:29:40 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games [2011.11.03 19:29:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GUILD WARS [2011.11.03 18:58:36 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Macromedia [2011.11.03 18:58:35 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Adobe [2011.11.03 18:58:18 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Macromed [2011.11.03 18:57:56 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Macromed [2011.11.03 18:39:16 | 000,000,000 | ---D | C] -- C:\Program Files\Creative [2011.11.03 18:39:11 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Creative Installation Information [2011.11.03 18:39:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Creative [2011.11.03 18:38:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Creative [2011.11.03 18:38:32 | 000,419,840 | ---- | C] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll [2011.11.03 18:38:31 | 000,413,696 | ---- | C] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll [2011.11.03 18:38:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenAL [2011.11.03 18:38:09 | 000,782,336 | ---- | C] (Creative Labs Inc.) -- C:\Windows\SysWow64\oalinst.exe [2011.11.03 18:38:09 | 000,077,824 | ---- | C] (Creative Labs) -- C:\Windows\SysWow64\eaxac3.dll [2011.11.03 18:38:09 | 000,014,336 | ---- | C] ( ) -- C:\Windows\SysWow64\a3d.dll [2011.11.03 18:38:09 | 000,012,800 | ---- | C] ( ) -- C:\Windows\SysWow64\killapps.exe [2011.11.03 18:37:50 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Data [2011.11.03 18:37:50 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\Data [2011.11.03 18:37:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Creative [2011.11.03 18:37:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Creative Labs Shared [2011.11.03 18:37:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Creative [2011.11.03 18:35:57 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\InstallShield Installation Information [2011.11.03 18:35:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield [2011.11.03 18:25:52 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Mozilla [2011.11.03 18:25:52 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Mozilla [2011.11.03 17:47:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Suite CBE 10 [2011.11.03 17:47:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab [2011.11.03 17:46:57 | 000,353,296 | ---- | C] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klif.sys [2011.11.03 17:45:20 | 000,000,000 | -HSD | C] -- C:\Windows\Installer [2011.11.03 17:42:14 | 000,000,000 | R--D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup [2011.11.03 17:42:14 | 000,000,000 | R--D | C] -- C:\Users\***\Searches [2011.11.03 17:42:14 | 000,000,000 | R--D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools [2011.11.03 17:42:06 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Identities [2011.11.03 17:42:05 | 000,000,000 | R--D | C] -- C:\Users\***\Contacts [2011.11.03 17:42:04 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\VirtualStore [2011.11.03 17:42:00 | 000,000,000 | --SD | C] -- C:\Users\***\AppData\Roaming\Microsoft [2011.11.03 17:42:00 | 000,000,000 | R--D | C] -- C:\Users\***\Saved Games [2011.11.03 17:42:00 | 000,000,000 | R--D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance [2011.11.03 17:42:00 | 000,000,000 | R--D | C] -- C:\Users\***\Links [2011.11.03 17:42:00 | 000,000,000 | R--D | C] -- C:\Users\***\Favorites [2011.11.03 17:42:00 | 000,000,000 | R--D | C] -- C:\Users\***\Downloads [2011.11.03 17:42:00 | 000,000,000 | R--D | C] -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories [2011.11.03 17:42:00 | 000,000,000 | -HSD | C] -- C:\Users\***\Vorlagen [2011.11.03 17:42:00 | 000,000,000 | -HSD | C] -- C:\Users\***\AppData\Local\Verlauf [2011.11.03 17:42:00 | 000,000,000 | -HSD | C] -- C:\Users\***\AppData\Local\Temporary Internet Files [2011.11.03 17:42:00 | 000,000,000 | -HSD | C] -- C:\Users\***\Startmenü [2011.11.03 17:42:00 | 000,000,000 | -HSD | C] -- C:\Users\***\SendTo [2011.11.03 17:42:00 | 000,000,000 | -HSD | C] -- C:\Users\***\Recent [2011.11.03 17:42:00 | 000,000,000 | -HSD | C] -- C:\Users\***\Netzwerkumgebung [2011.11.03 17:42:00 | 000,000,000 | -HSD | C] -- C:\Users\***\Lokale Einstellungen [2011.11.03 17:42:00 | 000,000,000 | -HSD | C] -- C:\Users\***\Eigene Dateien [2011.11.03 17:42:00 | 000,000,000 | -HSD | C] -- C:\Users\***\Druckumgebung [2011.11.03 17:42:00 | 000,000,000 | -HSD | C] -- C:\Users\***\Cookies [2011.11.03 17:42:00 | 000,000,000 | -HSD | C] -- C:\Users\***\AppData\Local\Anwendungsdaten [2011.11.03 17:42:00 | 000,000,000 | -HSD | C] -- C:\Users\***\Anwendungsdaten [2011.11.03 17:42:00 | 000,000,000 | -H-D | C] -- C:\Users\***\AppData [2011.11.03 17:42:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Temp [2011.11.03 17:42:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Microsoft [2011.11.03 17:42:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Media Center Programs [2011.11.03 17:41:50 | 000,000,000 | -HSD | C] -- C:\ProgramData\Vorlagen [2011.11.03 17:41:50 | 000,000,000 | -HSD | C] -- C:\ProgramData\Startmenü [2011.11.03 17:41:50 | 000,000,000 | -HSD | C] -- C:\Recovery [2011.11.03 17:41:50 | 000,000,000 | -HSD | C] -- C:\Programme [2011.11.03 17:41:50 | 000,000,000 | -HSD | C] -- C:\Program Files\Gemeinsame Dateien [2011.11.03 17:41:50 | 000,000,000 | -HSD | C] -- C:\ProgramData\Favoriten [2011.11.03 17:41:50 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Videos [2011.11.03 17:41:50 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Musik [2011.11.03 17:41:50 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Eigene Bilder [2011.11.03 17:41:50 | 000,000,000 | -HSD | C] -- C:\Dokumente und Einstellungen [2011.11.03 17:41:50 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumente [2011.11.03 17:41:50 | 000,000,000 | -HSD | C] -- C:\ProgramData\Anwendungsdaten [2011.11.03 17:27:01 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution [2011.11.03 17:24:28 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch [2011.11.03 17:24:11 | 000,000,000 | -HSD | C] -- C:\System Volume Information [2011.11.03 17:23:20 | 000,000,000 | ---D | C] -- C:\Windows\Panther [2011.11.03 17:23:07 | 000,000,000 | -HSD | C] -- C:\Boot ========== Files - Modified Within 30 Days ========== [2011.11.04 16:18:00 | 000,000,000 | ---- | M] () -- C:\Users\***\defogger_reenable [2011.11.04 15:55:29 | 000,013,728 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2011.11.04 15:55:29 | 000,013,728 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2011.11.04 15:10:49 | 000,584,192 | ---- | M] (OldTimer Tools) -- D:\Benutzer\***\Desktop\OTL.exe [2011.11.04 15:10:36 | 000,050,477 | ---- | M] () -- D:\Benutzer\***\Desktop\Defogger.exe [2011.11.04 14:54:58 | 000,001,532 | ---- | M] () -- C:\Users\Public\Desktop\Eraser.lnk [2011.11.04 14:52:07 | 009,183,120 | ---- | M] (The Eraser Project) -- D:\Benutzer\***\Documents\Eraser_6.0.8.2273.exe [2011.11.04 13:59:35 | 001,472,002 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2011.11.04 13:59:35 | 000,643,628 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2011.11.04 13:59:35 | 000,606,992 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2011.11.04 13:59:35 | 000,126,188 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2011.11.04 13:59:35 | 000,103,370 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2011.11.04 13:52:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.11.04 13:52:51 | 3220,529,152 | -HS- | M] () -- C:\hiberfil.sys [2011.11.04 13:52:07 | 000,062,884 | ---- | M] () -- C:\Windows\SysNative\BMXStateBkp-{00000004-00000000-00000000-00001102-0000000B-00431102}.rfx [2011.11.04 13:52:07 | 000,062,884 | ---- | M] () -- C:\Windows\SysNative\BMXState-{00000004-00000000-00000000-00001102-0000000B-00431102}.rfx [2011.11.04 13:52:07 | 000,000,820 | ---- | M] () -- C:\Windows\SysNative\DVCState-{00000004-00000000-00000000-00001102-0000000B-00431102}.rfx [2011.11.04 01:42:55 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2011.11.03 19:40:27 | 000,000,614 | ---- | M] () -- C:\Users\Public\Desktop\GUILD WARS.lnk [2011.11.03 18:38:32 | 000,419,840 | ---- | M] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll [2011.11.03 18:38:31 | 000,413,696 | ---- | M] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll [2011.11.03 18:38:31 | 000,000,159 | RH-- | M] () -- C:\Windows\ctfile.rfc [2011.11.03 18:25:08 | 000,000,753 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2011.11.03 18:19:21 | 000,274,464 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2011.11.03 17:52:36 | 000,152,233 | ---- | M] () -- C:\Windows\SysNative\drivers\klin.dat [2011.11.03 17:52:35 | 000,107,177 | ---- | M] () -- C:\Windows\SysNative\drivers\klick.dat [2011.11.03 17:46:57 | 000,353,296 | ---- | M] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klif.sys [2011.11.03 17:28:18 | 000,057,035 | ---- | M] () -- C:\Windows\SysWow64\license.rtf [2011.11.03 17:28:18 | 000,057,035 | ---- | M] () -- C:\Windows\SysNative\license.rtf [2011.11.03 17:23:08 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK ========== Files Created - No Company Name ========== [2011.11.04 16:18:00 | 000,000,000 | ---- | C] () -- C:\Users\***\defogger_reenable [2011.11.04 15:10:19 | 000,050,477 | ---- | C] () -- D:\Benutzer\***\Desktop\Defogger.exe [2011.11.04 14:54:58 | 000,001,532 | ---- | C] () -- C:\Users\Public\Desktop\Eraser.lnk [2011.11.04 14:54:58 | 000,001,532 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Eraser.lnk [2011.11.04 01:42:55 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_09_00.Wdf [2011.11.03 19:29:38 | 000,000,614 | ---- | C] () -- C:\Users\Public\Desktop\GUILD WARS.lnk [2011.11.03 18:40:03 | 000,062,884 | ---- | C] () -- C:\Windows\SysNative\BMXStateBkp-{00000004-00000000-00000000-00001102-0000000B-00431102}.rfx [2011.11.03 18:40:03 | 000,062,884 | ---- | C] () -- C:\Windows\SysNative\BMXState-{00000004-00000000-00000000-00001102-0000000B-00431102}.rfx [2011.11.03 18:40:03 | 000,000,820 | ---- | C] () -- C:\Windows\SysNative\DVCState-{00000004-00000000-00000000-00001102-0000000B-00431102}.rfx [2011.11.03 18:38:31 | 000,185,856 | ---- | C] () -- C:\Windows\SysNative\APOMgr64.DLL [2011.11.03 18:38:31 | 000,144,896 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL [2011.11.03 18:38:31 | 000,086,528 | ---- | C] () -- C:\Windows\SysNative\CmdRtr64.DLL [2011.11.03 18:38:31 | 000,071,168 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL [2011.11.03 18:38:31 | 000,000,159 | RH-- | C] () -- C:\Windows\ctfile.rfc [2011.11.03 18:38:09 | 002,167,684 | ---- | C] () -- C:\Windows\SysWow64\CT2MGM.SF2 [2011.11.03 18:38:09 | 002,167,684 | ---- | C] () -- C:\Windows\SysNative\CT2MGM.SF2 [2011.11.03 18:38:09 | 001,048,576 | ---- | C] () -- C:\Windows\SysWow64\CT1MGM.ROM [2011.11.03 18:38:09 | 001,048,576 | ---- | C] () -- C:\Windows\SysNative\CT1MGM.ROM [2011.11.03 18:38:09 | 000,384,428 | ---- | C] () -- C:\Windows\SysWow64\ctdnlstr.dat [2011.11.03 18:38:09 | 000,384,428 | ---- | C] () -- C:\Windows\SysNative\ctdnlstr.dat [2011.11.03 18:38:09 | 000,051,787 | ---- | C] () -- C:\Windows\SysWow64\ctdlang.dat [2011.11.03 18:38:09 | 000,051,787 | ---- | C] () -- C:\Windows\SysNative\ctdlang.dat [2011.11.03 18:38:09 | 000,027,273 | ---- | C] () -- C:\Windows\SysWow64\instwdm.ini [2011.11.03 18:38:09 | 000,027,273 | ---- | C] () -- C:\Windows\SysNative\instwdm.ini [2011.11.03 18:38:09 | 000,018,432 | ---- | C] () -- C:\Windows\SysNative\regplib.exe [2011.11.03 18:38:09 | 000,008,386 | ---- | C] () -- C:\Windows\SysWow64\CTAPO64.UDA [2011.11.03 18:38:09 | 000,007,680 | ---- | C] () -- C:\Windows\SysWow64\enlocstr.exe [2011.11.03 18:38:09 | 000,005,530 | ---- | C] () -- C:\Windows\SysWow64\CTMLFX64.UDA [2011.11.03 18:38:09 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CtxfiRes.dll [2011.11.03 18:38:09 | 000,002,560 | ---- | C] () -- C:\Windows\SysNative\CtxfiRes.dll [2011.11.03 18:38:09 | 000,001,688 | ---- | C] () -- C:\Windows\SysNative\XFi.bmp [2011.11.03 18:38:09 | 000,000,321 | ---- | C] () -- C:\Windows\SysWow64\kill.ini [2011.11.03 18:38:09 | 000,000,059 | ---- | C] () -- C:\Windows\SysWow64\default8.sfm [2011.11.03 18:38:09 | 000,000,059 | ---- | C] () -- C:\Windows\SysNative\default8.sfm [2011.11.03 18:38:09 | 000,000,059 | ---- | C] () -- C:\Windows\SysWow64\default4.sfm [2011.11.03 18:38:09 | 000,000,059 | ---- | C] () -- C:\Windows\SysNative\default4.sfm [2011.11.03 18:38:09 | 000,000,059 | ---- | C] () -- C:\Windows\SysWow64\default.sfm [2011.11.03 18:38:09 | 000,000,059 | ---- | C] () -- C:\Windows\SysNative\default.sfm [2011.11.03 18:38:09 | 000,000,054 | ---- | C] () -- C:\Windows\SysWow64\ctzapxx.ini [2011.11.03 18:38:09 | 000,000,054 | ---- | C] () -- C:\Windows\SysNative\ctzapxx.ini [2011.11.03 18:37:50 | 000,002,560 | ---- | C] () -- C:\Windows\SysWow64\CTXFIGER.DLL [2011.11.03 18:37:50 | 000,002,560 | ---- | C] () -- C:\Windows\SysNative\CTXFIGER.DLL [2011.11.03 18:37:37 | 000,007,062 | ---- | C] () -- C:\Windows\SysWow64\audiopid.vxd [2011.11.03 18:25:08 | 000,000,753 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk [2011.11.03 18:25:08 | 000,000,753 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2011.11.03 17:47:17 | 000,152,233 | ---- | C] () -- C:\Windows\SysNative\drivers\klin.dat [2011.11.03 17:47:17 | 000,107,177 | ---- | C] () -- C:\Windows\SysNative\drivers\klick.dat [2011.11.03 17:42:28 | 000,001,405 | ---- | C] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk [2011.11.03 17:42:23 | 000,001,439 | ---- | C] () -- C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk [2011.11.03 17:28:01 | 000,001,345 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk [2011.11.03 17:27:52 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk [2011.11.03 17:24:11 | 3220,529,152 | -HS- | C] () -- C:\hiberfil.sys [2011.11.03 17:23:08 | 000,008,192 | RHS- | C] () -- C:\BOOTSECT.BAK [2011.11.03 17:23:07 | 000,383,562 | RHS- | C] () -- C:\bootmgr [2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll [2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat ========== LOP Check ========== [2009.07.14 06:08:49 | 000,001,638 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.11.03 17:42:04 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2011.11.03 17:23:07 | 000,000,000 | -HSD | M] -- C:\Boot [2009.07.14 06:08:56 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2011.11.03 17:41:50 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs [2011.11.03 18:39:16 | 000,000,000 | R--D | M] -- C:\Program Files [2011.11.03 19:28:20 | 000,000,000 | R--D | M] -- C:\Program Files (x86) [2011.11.03 18:38:42 | 000,000,000 | -H-D | M] -- C:\ProgramData [2011.11.03 17:41:50 | 000,000,000 | -HSD | M] -- C:\Programme [2011.11.03 17:41:50 | 000,000,000 | -HSD | M] -- C:\Recovery [2011.11.04 16:20:34 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.11.03 17:41:57 | 000,000,000 | R--D | M] -- C:\Users [2011.11.03 18:39:38 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > < MD5 for: EXPLORER.EXE > [2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\SysWOW64\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe [2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe [2009.08.03 07:19:07 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe [2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\explorer.exe [2009.10.31 07:34:59 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe [2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe [2010.11.20 14:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe [2009.10.31 07:38:38 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe [2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe [2009.07.14 02:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe [2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe [2009.08.03 07:17:37 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe < MD5 for: REGEDIT.EXE > [2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=2E2C937846A0B8789E5E91739284D17A -- C:\Windows\winsxs\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5023a70bf589ad3e\regedit.exe [2009.07.14 02:39:29 | 000,427,008 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe [2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\SysWOW64\regedit.exe [2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\wow64_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_5a78515e29ea6f39\regedit.exe < MD5 for: USERINIT.EXE > [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\SysWOW64\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe [2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\SysNative\userinit.exe [2009.07.14 02:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe [2010.11.20 14:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe [2009.07.14 02:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2010.11.20 14:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SoftwareDistribution\Download\488053cdbca3231eeb2c2af7236d09ed\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe [2009.07.14 02:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe [2009.10.28 08:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe [2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\SysNative\winlogon.exe [2009.10.28 07:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > < > < End of report > |
| Themen zu Kido eingefangen und versucht zu entfernen. Ist mein Rechner jetzt sauber ? |
| 64-bit, bho, c:\windows\system32\rundll32.exe, dateien, eraser, explorer, explorer.exe, firefox, frage, html, installation, langs, logfile, löschen, microsoft, neu, programme, registry, rundll, scan, security, stick, tastatur, usb, usb stick, webcheck, windows, winlogon, winlogon.exe, worm |
Baum-Darstellung