| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Zeus Virus laut web.deWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
24.11.2011, 18:02
| #1 | |
 |  Zeus Virus laut web.de Hallo, ich sitze an dem PC von einer guten Bekannten. Sie hat heute von Web.de die weiter unten gepostete Mail erhalten. Da sie sich mit dem Computer noch weniger auskennt als ich und nun leicht verzweifelt ist und mir hier im Trojaner Board vor einiger Zeit schon einmal sehr geholfen wurde, hat sie mich um Hilfe gebeten. Hier der Text der Mail von Web.de: Zitat:
Ich habe hier im Forum folgenden Thread gefunden: www.trojaner-board.de/94580-zeus-virus-laut-web-de-abuse.html (Dort ist auch der Rest der Mail von Web.de zu sehen...die scheinen allen Betroffenen denselben Inhalt zu senden.) Ich habe die dort im zweiten Post (von markusg) gemachten Anweisungen übernommen. -> Download von OTL.exe und den dort angegebenen Text für die Textbox eingegeben. Ich hoffe das war so ok. Inhalt vom OTL.Txt-Editor: [CODE]xxxOTL Logfile: Code:
ATTFilter OTL logfile created on: 24.11.2011 15:20:22 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\XXX\Eigene Dateien\Downloads Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.11) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 1,50 Gb Total Physical Memory | 0,77 Gb Available Physical Memory | 51,51% Memory free 2,11 Gb Paging File | 1,48 Gb Available in Paging File | 70,25% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 24,41 Gb Total Space | 3,36 Gb Free Space | 13,74% Space Free | Partition Type: NTFS Drive D: | 43,95 Gb Total Space | 41,65 Gb Free Space | 94,77% Space Free | Partition Type: NTFS Drive I: | 917,07 Gb Total Space | 31,53 Gb Free Space | 3,44% Space Free | Partition Type: NTFS Drive P: | 150,00 Gb Total Space | 7,74 Gb Free Space | 5,16% Space Free | Partition Type: NTFS Drive Q: | 150,00 Gb Total Space | 7,74 Gb Free Space | 5,16% Space Free | Partition Type: NTFS Drive R: | 150,00 Gb Total Space | 7,74 Gb Free Space | 5,16% Space Free | Partition Type: NTFS Drive T: | 150,00 Gb Total Space | 7,74 Gb Free Space | 5,16% Space Free | Partition Type: NTFS Drive U: | 150,00 Gb Total Space | 7,74 Gb Free Space | 5,16% Space Free | Partition Type: NTFS Drive Z: | 29,99 Gb Total Space | 1,98 Gb Free Space | 6,61% Space Free | Partition Type: NTFS Computer Name: xxx | User Name: xxxu | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Dokumente und Einstellungen\XXX\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.) PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) PRC - C:\Programme\Trend Micro\BM\TMBMSRV.exe (Trend Micro Inc.) PRC - C:\Programme\Trend Micro\Client Server Security Agent\PccNTMon.exe (Trend Micro Inc.) PRC - C:\Programme\Trend Micro\Client Server Security Agent\TmListen.exe (Trend Micro Inc.) PRC - C:\Programme\Trend Micro\Client Server Security Agent\NTRtScan.exe (Trend Micro Inc.) PRC - C:\Programme\Trend Micro\Client Server Security Agent\CNTAoSMgr.exe (Trend Micro Inc.) PRC - C:\Programme\Trend Micro\Client Server Security Agent\TmPfw.exe (Trend Micro Inc.) PRC - C:\Programme\Trend Micro\Client Server Security Agent\TmProxy.exe (Trend Micro Inc.) PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation) PRC - C:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardManager.exe (DATEV eG) PRC - C:\DATEV\PROGRAMM\B0000150\ScWTS\DVCCSAWTSSetEntryNTE.exe (DATEV eG) PRC - C:\DATEV\PROGRAMM\B0000150\ScServer\DVckService.exe (DATEV eG) PRC - C:\DATEV\PROGRAMM\B0001364\DTVSCSer.exe (DATEV eG) PRC - C:\DATEV\PROGRAMM\B0001442\PSNTServ.exe (DATEV eG) PRC - C:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardService.exe (DATEV eG) PRC - C:\Programme\CAS-Software\CAS genesisWorld\Client\Genesis.exe (CAS Software AG) PRC - C:\Programme\3M\PSNLite\PsnLite.exe (3M) PRC - C:\Programme\3M\PSNLite\PSNGive.exe (3M) PRC - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation) PRC - C:\Programme\Mindjet\MindManager 5\sys\PDF\GER\W2K\PDFSaver.exe (Tracker Software Products) ========== Modules (No Company Name) ========== MOD - C:\Programme\Mozilla Firefox\js3250.dll () MOD - C:\Programme\Trend Micro\Client Server Security Agent\TmPfwCtl.dll () MOD - C:\DATEV\PROGRAMM\B0001364\DTVCmn.dll () MOD - C:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardServicePS.dll () MOD - C:\Programme\Adobe\Reader 8.0\Reader\ViewerPS.dll () MOD - C:\DATEV\PROGRAMM\B0001356\MCCRemControl.dll () MOD - C:\Programme\CAS-Software\CAS genesisWorld\Client\indy70.bpl () MOD - C:\WINDOWS\system32\nvapi.dll () MOD - C:\WINDOWS\system32\IMGMSGMO.dll () MOD - C:\Programme\Mindjet\MindManager 5\sys\PDF\GER\W2K\fmt_xmf.dll () MOD - C:\Programme\Mindjet\MindManager 5\sys\PDF\GER\W2K\xc_local.dll () MOD - C:\Programme\Mindjet\MindManager 5\sys\PDF\GER\W2K\fmt_xcx.dll () MOD - C:\Programme\Mindjet\MindManager 5\sys\PDF\GER\W2K\fmt_jb2.dll () MOD - C:\WINDOWS\system32\pdfcmnnt.dll () MOD - C:\WINDOWS\system32\HPBHealr.dll () ========== Win32 Services (SafeList) ========== SRV - (TMBMServer) -- C:\Programme\Trend Micro\BM\TMBMSRV.exe (Trend Micro Inc.) SRV - (tmlisten) -- C:\Programme\Trend Micro\Client Server Security Agent\tmlisten.exe (Trend Micro Inc.) SRV - (ntrtscan) -- C:\Programme\Trend Micro\Client Server Security Agent\ntrtscan.exe (Trend Micro Inc.) SRV - (TmPfw) -- C:\Programme\Trend Micro\Client Server Security Agent\TmPfw.exe (Trend Micro Inc.) SRV - (TmProxy) -- C:\Programme\Trend Micro\Client Server Security Agent\TmProxy.exe (Trend Micro Inc.) SRV - (FLEXnet Licensing Service) -- C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Macrovision Europe Ltd.) SRV - (DATEV Update-Service) -- C:\DATEV\PROGRAMM\INSTALL\DvInesASDSvc.Exe (DATEV eG) SRV - (DVckService) -- C:\DATEV\PROGRAMM\B0000150\ScServer\DVckService.exe (DATEV eG) SRV - (DVSmartCardLogon) -- C:\DATEV\PROGRAMM\B0001364\DTVSCSer.exe (DATEV eG) SRV - (DatevPrintService) -- C:\DATEV\PROGRAMM\B0001442\PSNTServ.exe (DATEV eG) SRV - (SCardService) -- C:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardService.exe (DATEV eG) SRV - (MDM) -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe (Microsoft Corporation) ========== Driver Services (SafeList) ========== DRV - (TmFilter) -- C:\Programme\Trend Micro\Client Server Security Agent\TmXPFlt.sys (Trend Micro Inc.) DRV - (TmPreFilter) -- C:\Programme\Trend Micro\Client Server Security Agent\tmpreflt.sys (Trend Micro Inc.) DRV - (VSApiNt) -- C:\Programme\Trend Micro\Client Server Security Agent\vsapiNT.sys (Trend Micro Inc.) DRV - (tmcomm) -- C:\WINDOWS\system32\drivers\tmcomm.sys (Trend Micro Inc.) DRV - (tmactmon) -- C:\WINDOWS\system32\drivers\tmactmon.sys (Trend Micro Inc.) DRV - (tmevtmgr) -- C:\WINDOWS\system32\drivers\tmevtmgr.sys (Trend Micro Inc.) DRV - (vmm) -- C:\WINDOWS\system32\drivers\VMM.sys (Microsoft Corporation) DRV - (pavboot) -- C:\WINDOWS\system32\drivers\pavboot.sys (Panda Security, S.L.) DRV - (tmcfw) -- C:\WINDOWS\system32\drivers\TM_CFW.sys (Trend Micro Inc.) DRV - (tmtdi) -- C:\WINDOWS\system32\drivers\tmtdi.sys (Trend Micro Inc.) DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation) DRV - (VPCNetS2) -- C:\WINDOWS\system32\drivers\VMNetSrv.sys (Microsoft Corporation) DRV - (KOBCCEX) -- C:\WINDOWS\system32\drivers\KOBCCEX.sys (KOBIL Systems GmbH) DRV - (KOBCCID) -- C:\WINDOWS\system32\drivers\KOBCCID.sys (KOBIL Systems GmbH) DRV - (vncdrv) -- C:\WINDOWS\system32\drivers\vncdrv.sys (RDV Soft) DRV - (ms_mpu401) -- C:\WINDOWS\system32\drivers\msmpu401.sys (Microsoft Corporation) DRV - (irsir) -- C:\WINDOWS\system32\drivers\irsir.sys (Microsoft Corporation) DRV - (fpcibase) -- C:\WINDOWS\system32\drivers\fpcibase.sys (AVM GmbH) DRV - (AVMWAN) -- C:\WINDOWS\system32\drivers\avmwan.sys (AVM GmbH) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-22328388-1409074215-931917085-1135\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "" FF - prefs.js..extensions.enabkkkItems: foxmarks@kei.com:4.0.2 FF - prefs.js..extensions.enabkkkItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabkkkItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabkkkItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.99 FF - prefs.js..extensions.enabkkkItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandasecurity.com/activescan: C:\Programme\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.11.09 15:22:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.11.09 15:22:21 | 000,000,000 | ---D | M] [2009.09.17 15:19:16 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Mozilla\Extensions [2011.11.24 12:02:45 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Mozilla\Firefox\Profiles\r8v9d9fk.default\extensions [2010.07.05 19:42:47 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Mozilla\Firefox\Profiles\r8v9d9fk.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.08.02 08:42:06 | 000,000,000 | ---D | M] (BitDefender QuickScan) -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Mozilla\Firefox\Profiles\r8v9d9fk.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2011.09.09 07:35:20 | 000,000,000 | ---D | M] ("Xmarks") -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Mozilla\Firefox\Profiles\r8v9d9fk.default\extensions\foxmarks@kei.com [2011.11.24 12:02:45 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2010.04.16 12:19:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2011.09.01 15:45:41 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2010.04.16 12:18:21 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAMME\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011.05.04 03:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll [2011.03.09 11:02:06 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.03.09 11:02:06 | 000,002,344 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2011.03.09 11:02:06 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2011.03.09 11:02:06 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2011.03.09 11:02:06 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2004.08.04 13:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (HelperObject Class) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Programme\TechSmith\SnagIt 7\SnagItBHO.dll (TechSmith Corporation) O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (SCardBHOEvent Class) - {AF8CD625-E04A-4A8F-A90A-0C74846C2E30} - C:\DATEV\SYSTEM\DVCCSASCardBHO002.dll (DATEV eG) O3 - HKLM\..\Toolbar: (SnagIt) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Programme\TechSmith\SnagIt 7\SnagItIEAddin.dll (TechSmith Corporation) O3 - HKU\S-1-5-21-22328388-1409074215-931917085-1135\..\Toolbar\WebBrowser: (no name) - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No CLSID value found. O4 - HKLM..\Run: [AUTOSTARTEXECUTE] "C:\DATEV\PROGRAMM\INSTALL\DvInesAutoStartHelper.Exe" -execute File not found O4 - HKLM..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd File not found O4 - HKLM..\Run: [DATEV_SCardMan] C:\DATEV\PROGRAMM\B0000347\ScMgmt\SCardManager.exe (DATEV eG) O4 - HKLM..\Run: [DTVLOGON] C:\DATEV\PROGRAMM\B0001364\DTVLOGON.EXE (DATEV eG) O4 - HKLM..\Run: [DVCCSAWTSSetEntryNTE] C:\DATEV\PROGRAMM\B0000150\ScWTS\DVCCSAWTSSetEntryNTE.exe (DATEV eG) O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb01.exe (HP) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [OE] C:\Programme\Trend Micro\Client Server Security Agent\TMAS_OE\TMAS_OEMon.exe (Trend Micro Inc.) O4 - HKLM..\Run: [OfficeScanNT Monitor] C:\Programme\Trend Micro\Client Server Security Agent\pccntmon.exe (Trend Micro Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKU\S-1-5-21-22328388-1409074215-931917085-1135..\Run: [{84D581D4-C612-3734-86BF-C851C5A8D7FD}] C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Fagow\acliy.exe (NEC Computers International) O4 - HKLM..\RunOnce: [0006 - C:\Dokumente und Einstellungen\XXXu\Startmenü\Programme\hp deskjet 950c series v3.2] C:\WINDOWS\command.com /c rmdir "C:\Dokumente und Einstellungen\XXXu\Startmenü\Programme\hp deskjet 950c series v3.2" File not found O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\MindManager PDF Writer.lnk = C:\Programme\Mindjet\MindManager 5\sys\PDF\GER\W2K\PDFSaver.exe (Tracker Software Products) O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Post-it® Software Notes Lite.lnk = C:\Programme\3M\PSNLite\PsnLite.exe (3M) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-22328388-1409074215-931917085-1135\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Computer, Inc.) O15 - HKU\S-1-5-21-22328388-1409074215-931917085-1135\..Trusted Domains: datev.at ([]http is out of zone range - 5) O15 - HKU\S-1-5-21-22328388-1409074215-931917085-1135\..Trusted Domains: datev.at ([]https is out of zone range - 5) O15 - HKU\S-1-5-21-22328388-1409074215-931917085-1135\..Trusted Domains: datev.com ([]http is out of zone range - 5) O15 - HKU\S-1-5-21-22328388-1409074215-931917085-1135\..Trusted Domains: datev.com ([]https is out of zone range - 5) O15 - HKU\S-1-5-21-22328388-1409074215-931917085-1135\..Trusted Domains: datev.de ([]http is out of zone range - 5) O15 - HKU\S-1-5-21-22328388-1409074215-931917085-1135\..Trusted Domains: datev.de ([]https is out of zone range - 5) O15 - HKU\S-1-5-21-22328388-1409074215-931917085-1135\..Trusted Domains: datev.de ([www] http is out of zone range - 5) O15 - HKU\S-1-5-21-22328388-1409074215-931917085-1135\..Trusted Domains: datev.de ([www] https is out of zone range - 5) O15 - HKU\S-1-5-21-22328388-1409074215-931917085-1135\..Trusted Domains: datevnet.de ([*.services] http is out of zone range - 5) O15 - HKU\S-1-5-21-22328388-1409074215-931917085-1135\..Trusted Domains: datevnet.de ([*.services] https is out of zone range - 5) O15 - HKU\S-1-5-21-22328388-1409074215-931917085-1135\..Trusted Domains: datevstadt.de ([]http is out of zone range - 5) O15 - HKU\S-1-5-21-22328388-1409074215-931917085-1135\..Trusted Domains: datevstadt.de ([]https is out of zone range - 5) O16 - DPF: {00134F72-5284-44F7-95A8-52A619F70751} https://MMMserver.MMM.local:4343/officescan/console/ClientInstall/WinNTChk.cab (ObjWinNTCheck Class) O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0080C859833B} https://MMMserver.MMM.local:4343/officescan/console/ClientInstall/setup.cab (OfficeScan Corp Edition Web-Deployment SetupCtrl Class) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177156292640 (WUWebControl Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1177158223343 (MUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {9BBB3919-F518-4D06-8209-299FC243FC44} https://MMMserver.MMM.local:4343/SMB/console/html/root/AtxEnc.cab (Encrypt Class) O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = MMM.local O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{288E2EC4-6E71-4BD1-8B6F-4694131A4979}: NameServer = 172.22.15.5,62.72.64.241 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\okkkb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrixxxul\MSITSS.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\DVCCSA: DllName - (DVCCSAnotify002.dll) - C:\WINDOWS\System32\DVCCSAnotify002.dll (DATEV eG) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\MMMBackground_4_3.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\MMMBackground_4_3.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2007.04.21 10:18:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: SCSI Class - Driver Group SafeBootMin: sermouse.sys - Driver SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vds - Service SafeBootMin: vga.sys - Driver SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: SCSI Class - Driver Group SafeBootNet: sermouse.sys - Driver SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vga.sys - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {0F1D198F-E5EA-4542-930E-2FB2B099F3F3} - LanaConfigTool_3383 ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vektorgrafik-Rendering (VML) ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4 ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML-Datenbindung für Java ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Erweitertes Authoring ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Sicherheitsupdate für Windows XP (KB923789) ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {64AABAD6-9CB4-D284-B328-F27E2FDDA4C0} - IE7 Uninstall Stub ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Taskplaner ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1 ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Reg Error: Value error. ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigIE ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE Drivers32: msacm.g723 - g723.acm File not found Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation) Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.) Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.) Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.) Drivers32: vidc.I263 - C:\WINDOWS\System32\i263_32.drv (Intel Corporation) Drivers32: vidc.I420 - C:\WINDOWS\System32\i263_32.drv (Intel Corporation) Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll () Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation) Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation) Drivers32: vidc.tscc - C:\WINDOWS\System32\tsccvid.dll (TechSmith Corporation) Drivers32: vidc.XVID - C:\WINDOWS\System32\xvidvfw.dll () CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2011.11.10 13:41:16 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXX\Lokale Einstellungen\Anwendungsdaten\Identities [2011.11.10 13:40:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Yxnotu [2011.11.10 13:40:56 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Fagow [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.11.24 14:58:28 | 000,000,679 | ---- | M] () -- C:\WINDOWS\hpbafd.ini [2011.11.24 14:00:54 | 000,191,517 | ---- | M] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Angebot kkk Show.pdf [2011.11.24 12:22:46 | 000,014,513 | ---- | M] () -- C:\WINDOWS\cfgall.ini [2011.11.24 11:24:22 | 000,183,841 | ---- | M] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Auftrittsinfos 02.12..pdf [2011.11.24 11:22:50 | 000,179,154 | ---- | M] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Auftrittsinfos 01.12.2011.pdf [2011.11.24 09:03:25 | 000,088,566 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2011.11.24 09:03:02 | 000,000,031 | ---- | M] () -- C:\tmuninst.ini [2011.11.24 09:02:44 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011.11.24 09:01:50 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011.11.24 09:01:48 | 1609,355,264 | -HS- | M] () -- C:\hiberfil.sys [2011.11.21 10:40:58 | 000,183,127 | ---- | M] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Rechnung kkk Show Medica.pdf [2011.11.18 12:18:25 | 000,186,869 | ---- | M] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Invoice kkk.pdf [2011.11.18 10:42:31 | 000,027,241 | ---- | M] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Gesangsrepertoire xxxu Wirbelwind.pdf [2011.11.18 10:24:59 | 000,021,383 | ---- | M] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Sie haben die Wahl.pdf [2011.11.18 10:24:10 | 000,030,451 | ---- | M] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Lieblingslieder.pdf [2011.11.09 15:49:07 | 000,001,879 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2011.11.08 09:01:59 | 000,508,568 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2011.11.08 09:01:59 | 000,445,842 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2011.11.08 09:01:59 | 000,100,036 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2011.11.08 09:01:59 | 000,073,094 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2011.11.02 11:03:42 | 000,000,462 | ---- | M] () -- C:\Dokumente und Einstellungen\XXX\Desktop\kkk.lnk [4 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.11.24 11:24:19 | 000,183,841 | ---- | C] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Auftrittsinfos 02.12..pdf [2011.11.24 11:22:48 | 000,179,154 | ---- | C] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Auftrittsinfos 01.12.2011.pdf [2011.11.22 10:59:30 | 000,191,517 | ---- | C] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Angebot kkk Show.pdf [2011.11.21 10:40:54 | 000,183,127 | ---- | C] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Rechnung kkk Show Medica.pdf [2011.11.18 12:18:23 | 000,186,869 | ---- | C] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Invoice kkk.pdf [2011.11.18 10:42:30 | 000,027,241 | ---- | C] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Gesangsrepertoire xxxu Wirbelwind.pdf [2011.11.18 10:24:59 | 000,021,383 | ---- | C] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Sie haben die Wahl.pdf [2011.11.18 10:24:07 | 000,030,451 | ---- | C] () -- C:\Dokumente und Einstellungen\XXX\Desktop\Lieblingslieder.pdf [2010.05.26 11:18:56 | 000,000,378 | ---- | C] () -- C:\WINDOWS\dtools.INI [2009.12.05 14:19:54 | 000,005,756 | ---- | C] () -- C:\WINDOWS\cfgspyps.ini [2009.12.05 14:19:52 | 000,006,598 | ---- | C] () -- C:\WINDOWS\cfgps.ini [2009.11.03 10:31:01 | 000,463,928 | ---- | C] () -- C:\WINDOWS\System32\prfh0407.dat [2009.11.03 10:31:01 | 000,085,442 | ---- | C] () -- C:\WINDOWS\System32\prfc0407.dat [2009.10.17 14:56:58 | 000,114,688 | ---- | C] () -- C:\WINDOWS\DVGRF.DLL [2009.10.17 14:56:58 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\IMGMSGMO.dll [2009.10.17 14:56:54 | 000,000,817 | ---- | C] () -- C:\WINDOWS\Tobit.ini [2009.10.17 14:56:25 | 000,000,023 | ---- | C] () -- C:\WINDOWS\AVFD.INI [2009.10.17 14:56:13 | 004,877,312 | ---- | C] () -- C:\WINDOWS\TOBITCLT.DLL [2009.10.17 14:55:03 | 000,000,291 | ---- | C] () -- C:\WINDOWS\TOBITADD.INI [2009.09.17 15:19:29 | 000,005,120 | ---- | C] () -- C:\Dokumente und Einstellungen\XXX\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009.09.17 15:14:24 | 000,014,513 | ---- | C] () -- C:\WINDOWS\cfgall.ini [2009.09.15 09:25:31 | 000,000,021 | ---- | C] () -- C:\WINDOWS\KurusDeinstall.INI [2008.10.27 14:45:16 | 000,000,008 | ---- | C] () -- C:\WINDOWS\System32\nvModes.dat [2008.07.23 13:43:57 | 002,463,976 | ---- | C] () -- C:\WINDOWS\System32\NPSWF32.dll [2008.05.29 14:08:55 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI [2008.03.10 15:20:42 | 000,000,071 | ---- | C] () -- C:\WINDOWS\CDMP_HtmlViewer.INI [2008.03.10 15:20:31 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD_Start.INI [2007.12.11 17:26:24 | 000,000,021 | ---- | C] () -- C:\WINDOWS\DvInesKurusOleServer002.INI [2007.12.11 17:07:46 | 000,000,118 | ---- | C] () -- C:\WINDOWS\dvinesinstalllocation001.INI [2007.12.11 17:07:42 | 000,000,118 | ---- | C] () -- C:\WINDOWS\dvinesinstart001.INI [2007.12.11 17:05:24 | 000,000,021 | ---- | C] () -- C:\WINDOWS\Startup.INI [2007.09.06 18:21:44 | 000,038,496 | ---- | C] () -- C:\WINDOWS\System32\JNILibrary.dll [2007.09.06 18:21:36 | 000,108,128 | ---- | C] () -- C:\WINDOWS\System32\INetCert.dll [2007.04.23 18:33:51 | 000,000,679 | ---- | C] () -- C:\WINDOWS\hpbafd.ini [2007.04.23 18:33:15 | 000,094,274 | ---- | C] () -- C:\WINDOWS\System32\HPBHealr.dll [2007.04.23 15:03:55 | 000,001,674 | ---- | C] () -- C:\WINDOWS\wininit.ini [2007.04.23 14:42:48 | 000,233,472 | R--- | C] () -- C:\WINDOWS\System32\cmirmdrv.exe [2007.04.23 14:42:47 | 000,028,672 | R--- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll [2007.04.22 11:38:39 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL [2007.04.22 11:38:39 | 000,040,129 | ---- | C] () -- C:\WINDOWS\iccsigs.dat [2007.04.22 11:38:39 | 000,000,048 | ---- | C] () -- C:\WINDOWS\KPCMS.INI [2007.04.22 10:17:19 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\Iyvu9_32.dll [2007.04.22 10:16:05 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll [2007.04.22 10:04:48 | 000,000,000 | ---- | C] () -- C:\WINDOWS\muma2003.INI [2007.04.22 09:40:26 | 000,000,051 | ---- | C] () -- C:\WINDOWS\magix.ini [2007.04.22 09:40:25 | 000,000,747 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini [2007.04.21 17:44:42 | 000,000,667 | ---- | C] () -- C:\WINDOWS\mozver.dat [2007.04.21 15:27:14 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2007.04.21 15:04:54 | 000,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2007.04.21 15:04:54 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2007.04.21 14:51:51 | 000,000,415 | ---- | C] () -- C:\WINDOWS\graphedt.INI [2007.04.21 12:24:05 | 000,081,984 | ---- | C] () -- C:\WINDOWS\System32\bdod.bin [2007.04.21 10:51:51 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2007.04.21 10:50:38 | 000,341,832 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2007.04.21 10:41:20 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2007.04.21 10:21:16 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2007.04.21 10:15:00 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2006.10.22 12:22:00 | 001,662,976 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2006.10.22 12:22:00 | 001,622,016 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe [2006.10.22 12:22:00 | 001,470,464 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2006.10.22 12:22:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe [2006.10.22 12:22:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2006.10.22 12:22:00 | 000,581,632 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll [2006.10.22 12:22:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2006.10.22 12:22:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe [2006.10.22 12:22:00 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe [2006.10.22 12:22:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2006.10.22 12:22:00 | 000,212,992 | ---- | C] () -- C:\WINDOWS\System32\nvapi.dll [2005.06.11 10:47:00 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\fpprintmon.dll [2004.08.04 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2004.08.04 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2004.08.04 13:00:00 | 000,508,568 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2004.08.04 13:00:00 | 000,445,842 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2004.08.04 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2004.08.04 13:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2004.08.04 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2004.08.04 13:00:00 | 000,100,036 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2004.08.04 13:00:00 | 000,073,094 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2004.08.04 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2004.08.04 13:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2004.08.04 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2004.08.04 13:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2004.08.04 13:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2004.08.04 13:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2004.08.04 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2001.10.28 16:42:30 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll ========== LOP Check ========== [2007.04.21 15:03:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\3M [2007.06.09 08:10:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\CAS genesisWorld [2007.04.21 13:21:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\Mindjet [2007.10.05 15:17:16 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\RhinoSoft.com [2007.09.04 13:13:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Admin\Anwendungsdaten\TuneUp Software [2007.04.25 16:46:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\3M [2007.12.11 18:39:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\DATEV [2009.09.17 12:44:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\administrator.MMM\Anwendungsdaten\3M [2009.09.17 13:43:52 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\administrator.MMM\Anwendungsdaten\DATEV [2009.10.17 14:57:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\administrator.MMM\Anwendungsdaten\Mindjet [2009.10.17 14:57:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\administrator.MMM\Anwendungsdaten\Tobit [2007.09.04 13:13:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software [2009.08.20 14:23:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ausbildung\Anwendungsdaten\3M [2009.08.20 14:33:09 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\Ausbildung\Anwendungsdaten\DATEV [2009.09.29 11:15:06 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\mmm\Anwendungsdaten\3M [2009.09.29 12:59:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\mmm\Anwendungsdaten\DATEV [2007.04.23 08:10:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxxu\Anwendungsdaten\3M [2009.07.28 10:56:08 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxxu\Anwendungsdaten\CAS genesisWorld [2009.03.17 09:01:42 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\xxxu\Anwendungsdaten\DATEV [2009.09.17 14:31:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\3M [2009.09.17 15:19:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\CAS genesisWorld [2009.09.17 14:34:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\DATEV [2011.11.10 13:40:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Fagow [2009.11.03 11:54:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Mindjet [2010.06.25 12:40:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\QuickScan [2009.11.03 14:36:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\TeamViewer [2011.08.31 14:15:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\TippKönigin [2010.02.19 10:02:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Tobit [2011.11.24 15:24:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Yxnotu [2009.09.18 11:58:55 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXyyy\Anwendungsdaten\3M [2009.11.23 10:09:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\fff\Anwendungsdaten\3M [2010.11.17 13:43:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\fff\Anwendungsdaten\CAS genesisWorld [2010.02.16 15:09:43 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\fff\Anwendungsdaten\DATEV [2010.06.30 13:11:57 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\fff\Anwendungsdaten\Mindjet [2010.06.30 13:11:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\fff\Anwendungsdaten\Tobit [2009.11.03 11:54:31 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\LocalService\Anwendungsdaten\Tobit [2007.04.21 15:21:54 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\YYY\Anwendungsdaten\3M [2007.07.15 13:00:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\YYY\Anwendungsdaten\CAS genesisWorld [2008.06.24 10:57:59 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\YYY\Anwendungsdaten\DATEV [2009.09.17 15:05:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXu\Anwendungsdaten\3M [2009.09.17 15:14:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXu\Anwendungsdaten\CAS genesisWorld [2009.09.17 15:14:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXu\Anwendungsdaten\DATEV [2011.10.04 17:37:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXu\Anwendungsdaten\TippKönigin [2009.11.03 17:12:38 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXXu\Anwendungsdaten\Tobit [2011.09.02 16:15:00 | 000,000,396 | ---- | M] () -- C:\WINDOWS\Tasks\1-Klick-Wartung.job ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2009.09.17 14:31:13 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\3M [2009.09.17 15:19:20 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Adobe [2010.03.24 13:36:48 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Apple Computer [2009.09.17 15:19:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\CAS genesisWorld [2009.09.17 14:34:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\DATEV [2011.11.10 13:40:56 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Fagow [2009.09.17 15:19:19 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Identities [2009.09.17 15:19:18 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Macromedia [2011.10.24 12:17:21 | 000,000,000 | --SD | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Microsoft [2009.11.03 11:54:53 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Mindjet [2009.09.17 15:19:12 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Mozilla [2010.06.25 12:40:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\QuickScan [2009.09.17 15:19:10 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Sun [2009.11.03 14:36:34 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\TeamViewer [2011.08.31 14:15:58 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\TippKönigin [2010.02.19 10:02:28 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Tobit [2011.05.04 15:36:01 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\vlc [2011.11.24 15:24:33 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Yxnotu < %APPDATA%\*.exe /s > [2011.08.06 08:41:46 | 000,189,952 | ---- | M] (NEC Computers International) -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Fagow\acliy.exe [2010.07.29 10:18:40 | 002,605,008 | ---- | M] (Adobe Systems, Inc.) -- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2004.08.04 13:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys [2008.10.02 11:15:34 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys [2008.10.02 11:15:34 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys [2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys [2008.04.13 19:36:38 | 000,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys < MD5 for: ATAPI.SYS > [2004.08.04 13:00:00 | 018,782,319 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys [2008.10.02 11:15:34 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys [2008.10.02 11:15:34 | 023,898,261 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys [2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys [2008.04.13 19:40:30 | 000,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys [2004.08.04 13:00:00 | 000,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys < MD5 for: EVENTLOG.DLL > [2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll [2008.04.14 03:22:10 | 000,056,320 | ---- | M] (Microsoft Corporation) MD5=04955AA695448C181B367D964AF158AA -- C:\WINDOWS\system32\eventlog.dll [2004.08.04 13:00:00 | 000,055,808 | ---- | M] (Microsoft Corporation) MD5=B932C077D5A65B71B4512544AC404CB4 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll < MD5 for: EXPLORER.EXE > [2004.08.04 13:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) MD5=22FE1BE02EADDE1632E478E4125639E0 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe [2007.06.13 14:10:08 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=331ED93570BAF3CFE30340298762CD56 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe [2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe [2008.04.14 03:22:45 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe [2007.06.13 14:21:45 | 001,036,288 | ---- | M] (Microsoft Corporation) MD5=64D320C0E301EEDC5A4ADBBDC5024F7F -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe < MD5 for: NETLOGON.DLL > [2008.04.14 03:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll [2008.04.14 03:22:19 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=0098D35F91DEAB9C127360A877F2CF84 -- C:\WINDOWS\system32\netlogon.dll [2004.08.04 13:00:00 | 000,407,040 | ---- | M] (Microsoft Corporation) MD5=D27395EDCD3416AFD125A9370DCB585C -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll < MD5 for: SCECLI.DLL > [2008.04.14 03:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll [2008.04.14 03:22:23 | 000,187,904 | ---- | M] (Microsoft Corporation) MD5=5132443DF6FC3771A17AB4AE55DCBC28 -- C:\WINDOWS\system32\scecli.dll [2004.08.04 13:00:00 | 000,186,880 | ---- | M] (Microsoft Corporation) MD5=64DC26B3CF7BCCAD431CE360A4C625D5 -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll < MD5 for: USER32.DLL > [2005.03.02 19:09:46 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=3751D7CF0E0A113D84414992146BCE6A -- C:\WINDOWS\$NtUninstallKB925902$\user32.dll [2007.03.08 16:36:30 | 000,579,072 | ---- | M] (Microsoft Corporation) MD5=492E166CFD26A50FB9160DB536FF7D2B -- C:\WINDOWS\$NtServicePackUninstall$\user32.dll [2005.03.02 19:19:56 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=4C90159A69A5FD3EB39C71411F28FCFF -- C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\user32.dll [2004.08.04 13:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) MD5=56785FD5236D7B22CF471A6DA9DB46D8 -- C:\WINDOWS\$NtUninstallKB890859$\user32.dll [2007.03.08 16:48:39 | 000,579,584 | ---- | M] (Microsoft Corporation) MD5=78785EFF8CB90CEC1862A4CCFD9A3C3A -- C:\WINDOWS\$hf_mig$\KB925902\SP2QFE\user32.dll [2008.04.14 03:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\ServicePackFiles\i386\user32.dll [2008.04.14 03:22:31 | 000,580,096 | ---- | M] (Microsoft Corporation) MD5=B0050CC5340E3A0760DD8B417FF7AEBD -- C:\WINDOWS\system32\user32.dll < MD5 for: USERINIT.EXE > [2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2008.04.14 03:23:03 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe [2004.08.04 13:00:00 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=D1E53DC57143F2584B1DD53B036C0633 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe < MD5 for: VIAMRAID.SYS > [2004.03.29 06:45:36 | 000,073,600 | R--- | M] (VIA Technologies inc,.ltd) MD5=65864ABA65EEE06EA586009301834E43 -- C:\WINDOWS\system32\drivers\viamraid.sys < MD5 for: WINLOGON.EXE > [2004.08.04 13:00:00 | 000,507,392 | ---- | M] (Microsoft Corporation) MD5=2B6A0BAF33A9918F09442D873848FF72 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe [2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe [2008.04.14 03:23:05 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\system32\winlogon.exe < MD5 for: WS2IFSL.SYS > [2004.08.04 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\dllcache\ws2ifsl.sys [2004.08.04 13:00:00 | 000,012,032 | ---- | M] (Microsoft Corporation) MD5=6ABE6E225ADB5A751622A9CC3BC19CE8 -- C:\WINDOWS\system32\drivers\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > [2007.04.21 11:49:37 | 000,094,208 | ---- | M] () -- C:\WINDOWS\System32\config\default.sav [2007.04.21 11:49:37 | 000,663,552 | ---- | M] () -- C:\WINDOWS\System32\config\software.sav [2007.04.21 11:49:37 | 000,438,272 | ---- | M] () -- C:\WINDOWS\System32\config\system.sav < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [4 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ] < End of report > Und hier der Inhalt von Extras.txt: OTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 24.11.2011 15:20:22 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\xxx.YYY\Eigene Dateien\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.11)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,50 Gb Total Physical Memory | 0,77 Gb Available Physical Memory | 51,51% Memory free
2,11 Gb Paging File | 1,48 Gb Available in Paging File | 70,25% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 24,41 Gb Total Space | 3,36 Gb Free Space | 13,74% Space Free | Partition Type: NTFS
Drive D: | 43,95 Gb Total Space | 41,65 Gb Free Space | 94,77% Space Free | Partition Type: NTFS
Drive I: | 917,07 Gb Total Space | 31,53 Gb Free Space | 3,44% Space Free | Partition Type: NTFS
Drive P: | 150,00 Gb Total Space | 7,74 Gb Free Space | 5,16% Space Free | Partition Type: NTFS
Drive Q: | 150,00 Gb Total Space | 7,74 Gb Free Space | 5,16% Space Free | Partition Type: NTFS
Drive R: | 150,00 Gb Total Space | 7,74 Gb Free Space | 5,16% Space Free | Partition Type: NTFS
Drive T: | 150,00 Gb Total Space | 7,74 Gb Free Space | 5,16% Space Free | Partition Type: NTFS
Drive U: | 150,00 Gb Total Space | 7,74 Gb Free Space | 5,16% Space Free | Partition Type: NTFS
Drive Z: | 29,99 Gb Total Space | 1,98 Gb Free Space | 6,61% Space Free | Partition Type: NTFS
Computer Name: XXX | User Name: xxx | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
[HKEY_USERS\S-1-5-21-22328388-1409074215-931917085-1135\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
jsfile [edit] -- "C:\Programme\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1" (Macromedia, Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabuuu" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications]
"Enabuuu" = 1
"AllowUserPrefMerge" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts]
"Enabuuu" = 1
"AllowUserPrefMerge" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\GloballyOpenPorts\List]
"135:TCP:*:Enabuuu:Offer Remote Assistance - Port" = 135:TCP:*:Enabuuu:Offer Remote Assistance - Port
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\FileAndPrint]
"Enabuuu" = 1
"RemoteAddresses" = LocalSubnet
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\RemoteDesktop]
"Enabuuu" = 1
"RemoteAddresses" = *
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\AuthorizedApplications]
"AllowUserPrefMerge" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\GloballyOpenPorts]
"AllowUserPrefMerge" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabuuu:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabuuu:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabuuu:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabuuu:@xpsp2res.dll,-22002
"57805:TCP" = 57805:TCP:*:Enabuuu:Trend Micro Client/Server Security Agent Listener
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabuuu:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabuuu:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabuuu:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabuuu:@xpsp2res.dll,-22002
"35774:TCP" = 35774:TCP:*:Enabuuu:Trend Micro Client/Server Security Agent Listener
"57805:TCP" = 57805:TCP:*:Enabuuu:Trend Micro Client/Server Security Agent Listener
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\DATEV\PROGRAMM\Sws\LimaServer.exe" = C:\DATEV\PROGRAMM\SWS\LimaServer.exe:*:Enabuuu:LimaServer.exe -- (DATEV eG)
"C:\DATEV\PROGRAMM\Sws\LimaService.exe" = C:\DATEV\PROGRAMM\SWS\LimaService.exe:*:Enabuuu:LimaService.exe -- (DATEV eG)
"C:\DATEV\PROGRAMM\B0000195\ADDMAN\DATxxxddMan.exe" = C:\DATEV\PROGRAMM\B0000195\ADDMAN\DATxxxddMan.exe:*:Enabuuu:DATxxxddMan.exe -- (DATEV eG)
"C:\Dokumente und Einstellungen\xxx.YYY\temp\TeamViewer\Version4\TeamViewer.exe" = C:\Dokumente und Einstellungen\xxx.YYY\temp\TeamViewer\Version4\TeamViewer.exe:*:Enabuuu:TeamViewer Remote Control Application -- (TeamViewer GmbH)
"C:\Programme\Funkwerk\Funkwerk Dime Manager V1.1.2\Bin\DimeM.exe" = C:\Programme\Funkwerk\Funkwerk Dime Manager V1.1.2\Bin\DimeM.exe:*:Enabuuu:Dime Manager -- (Funkwerk)
"C:\Programme\Funkwerk\BRICKware\dtools.exe" = C:\Programme\Funkwerk\BRICKware\dtools.exe:*:Enabuuu:DIME Tools -- (Funkwerk Enterprise Communications GmbH)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\UltraVNC\vncviewer.exe" = C:\Programme\UltraVNC\vncviewer.exe:*:Enabuuu:VNCViewer
"C:\Programme\Macromedia\Contribute 302\Contribute.exe" = C:\Programme\Macromedia\Contribute 302\Contribute.exe:*:Enabuuu:Contribute
"C:\Programme\ESTsoft\ALFTP\ALFTP.exe" = C:\Programme\ESTsoft\ALFTP\ALFTP.exe:*:Enabuuu:ALFTP -- (ESTsoft)
"C:\DATEV\PROGRAMM\Sws\LimaServer.exe" = C:\DATEV\PROGRAMM\SWS\LimaServer.exe:*:Enabuuu:LimaServer.exe -- (DATEV eG)
"C:\DATEV\PROGRAMM\Sws\LimaService.exe" = C:\DATEV\PROGRAMM\SWS\LimaService.exe:*:Enabuuu:LimaService.exe -- (DATEV eG)
"C:\DATEV\PROGRAMM\B0000195\ADDMAN\DATxxxddMan.exe" = C:\DATEV\PROGRAMM\B0000195\ADDMAN\DATxxxddMan.exe:*:Enabuuu:DATxxxddMan.exe -- (DATEV eG)
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{008F9A3A-24A0-408B-AD7F-95C414219A00}" = Adobe Setup
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{0F022A2E-7022-497D-90A5-0F46746D8275}" = Macromedia Extension Manager
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{1C9E74DA-C34A-428E-9134-3D24EDE97868}" = Ascotel IntelliGate First-party TAPI Service Provider
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 26
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4360BB46-507E-4361-8DCB-4FF9BDC9907B}" = SnagIt 7
"{44025BD7-AD10-4769-99AE-6378FD0303D6}" = Macromedia Dreamweaver 8
"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{735DEB9C-61BD-4D31-994B-92395BBB4E45}" = Microsoft XML Parser
"{73B5D990-04EA-4751-B10F-5534770B91F2}" = Adobe Color EU Recommended Settings
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime
"{82A2836E-7430-4B02-B1A3-ED47A13A775C}" = CAS genesisWorld
"{885A63EA-382B-4DD4-A755-14809B8557D6}" = Macromedia Flash Player 8
"{8A7CAA24-7B23-410B-A7C3-F994B0944160}" = Microsoft Virtual PC 2007
"{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}" = Macromedia Flash 8 Video Encoder
"{8C640345-AF96-4ABA-A697-97D2A0B8C6DB}" = Adobe Flash CS3
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{91057632-CA70-413C-B628-2D3CDBBB906B}" = Macromedia Flash Player 8 Plugin
"{91130407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Small Business
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}" = QuickTime
"{990271CA-3B5D-4C0F-8D3B-3B748AE73E32}" = CDMenuPro V6
"{9B567E98-126E-4CD0-BF9B-163345BF7852}" = MindManager X5 Pro
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A6FC545E-109B-471F-ACBB-C042881FC40D}" = CAS Word Addin
"{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings
"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.3 - Deutsch
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}" = Apple Software Update
"{BCEDD813-269C-4D8F-A4BA-01FDC66254D3}" = Adobe Flash Video Encoder
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C94C0675-BF09-4A4D-A49C-8A78518E920C}" = Funkwerk Dime Manager V1.1.2
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{FC7BACF0-1FFA-4605-B3B4-A66AB382752D}" = XML Notepad 2007
"{FF29A7E2-FF40-4D07-B7E4-2093DE59E10A}" = Adobe Color NA Extra Settings
"ActiveScan 2.0" = Panda ActiveScan 2.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe_2225677e524ae91efb80c700be972bf" = Adobe Flash CS3 Professional
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"Advanced IP Scanner v1.5" = Advanced IP Scanner v1.5
"Advanced Port Scanner v1.3" = Advanced Port Scanner v1.3
"ALFTP_is1" = ALFTP
"BRICKware_is1" = BRICKware 7.5.4
"C-Media Audio Driver" = C-Media WDM Audio Driver
"CodInstl" = Intel A/V Codecs V2.0
"David.InfoCenter" = David.InfoCenter
"HP LaserJet 2200 Uninstaller" = HP LaserJet 2200 Deinstallationsprogramm
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{82A2836E-7430-4B02-B1A3-ED47A13A775C}" = CAS genesisWorld
"Macromedia FreeHand 8" = Macromedia FreeHand 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.24)" = Mozilla Firefox (3.6.24)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Notepad++" = Notepad++
"NVIDIA Drivers" = NVIDIA Drivers
"OfficeScanNT" = Trend Micro Client/Server Security Agent
"PSN" = Post-it® Software Notes Lite
"TippKönigin_is1" = TippKönigin 5.5
"VLC media player" = VLC media player 1.1.5
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR Archivierer
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xvid_is1" = Xvid 1.1.2 final uninstall
"YTdetect" = Yahoo! Detect
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-22328388-1409074215-931917085-1135\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"CGoban 3" = CGoban 3
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 16.11.2011 10:32:30 | Computer Name = XXX | Source = CASEventLog | ID = 131073
Description = An internal error occurred: Windows account: xxx Context: Shared.LowLevelTools
ERRORLOG
Access violation at address 00080084. Read of address 00080084
Error - 18.11.2011 06:15:58 | Computer Name = XXX | Source = CASEventLog | ID = 131073
Description = An internal error occurred: Windows account: xxx Context: Shared.LowLevelTools
ERRORLOG
Error - 18.11.2011 06:15:58 | Computer Name = XXX | Source = CASEventLog | ID = 131073
Description = An internal error occurred: Windows account: xxx Context: Shared.LowLevelTools
ERRORLOG
TWCAxSession: TTWCAxSession: Access violation at address 6F690000. Read of address
6F690000
Error - 21.11.2011 07:06:44 | Computer Name = XXX | Source = CASEventLog | ID = 131073
Description = An internal error occurred: Windows account: xxx Context: Shared.ServerFactory
CreateGWDataService2
Klasse
nicht registriert
Error - 21.11.2011 07:06:44 | Computer Name = XXX | Source = CASEventLog | ID = 131073
Description = An internal error occurred: Windows account: xxx Context: Shared.OptionsClass
Username:
xxx ReadOptionsFromDB Rescope=EMail / General OID=-1 Klasse nicht registriert
Error - 23.11.2011 09:07:37 | Computer Name = XXX | Source = CASEventLog | ID = 131073
Description = An internal error occurred: Windows account: xxx Context: Shared.LowLevelTools
ERRORLOG
Error - 23.11.2011 09:07:38 | Computer Name = XXX | Source = CASEventLog | ID = 131073
Description = An internal error occurred: Windows account: xxx Context: Shared.LowLevelTools
ERRORLOG
TApplication: Control '' has no parent window
Error - 24.11.2011 08:20:28 | Computer Name = XXX | Source = CASEventLog | ID = 131073
Description = An internal error occurred: Windows account: xxx Context: Shared.uAddressTools
SendEmailRegardingSalesActivity
Access
violation at address CCCCFFFE. Read of address CCCCFFFE
Error - 24.11.2011 08:20:28 | Computer Name = XXX | Source = CASEventLog | ID = 131073
Description = An internal error occurred: Windows account: xxx Context: Shared.LowLevelTools
ERRORLOG
Error - 24.11.2011 08:20:30 | Computer Name = XXX | Source = CASEventLog | ID = 131073
Description = An internal error occurred: Windows account: xxx Context: Shared.LowLevelTools
ERRORLOG
Exception im Globalen Exception-Handler: Access violation at address CCCCFFFE.
Read of address CCCCFFFE
[ System Events ]
Error - 07.11.2011 03:50:57 | Computer Name = XXX | Source = BROWSER | ID = 8032
Description = Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport
"\Device\NetBT_Tcpip_{288E2EC4-6E71-4BD1-8B6F-4694131A4979}" zu oft fehl. Der Sicherungssuchdienst
wird beendet.
Error - 08.11.2011 04:11:29 | Computer Name = XXX | Source = BROWSER | ID = 8032
Description = Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport
"\Device\NetBT_Tcpip_{288E2EC4-6E71-4BD1-8B6F-4694131A4979}" zu oft fehl. Der Sicherungssuchdienst
wird beendet.
Error - 11.11.2011 10:37:10 | Computer Name = XXX | Source = BROWSER | ID = 8032
Description = Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport
"\Device\NetBT_Tcpip_{288E2EC4-6E71-4BD1-8B6F-4694131A4979}" zu oft fehl. Der Sicherungssuchdienst
wird beendet.
Error - 14.11.2011 04:17:31 | Computer Name = XXX | Source = BROWSER | ID = 8032
Description = Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport
"\Device\NetBT_Tcpip_{288E2EC4-6E71-4BD1-8B6F-4694131A4979}" zu oft fehl. Der Sicherungssuchdienst
wird beendet.
Error - 15.11.2011 03:54:36 | Computer Name = XXX | Source = BROWSER | ID = 8032
Description = Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport
"\Device\NetBT_Tcpip_{288E2EC4-6E71-4BD1-8B6F-4694131A4979}" zu oft fehl. Der Sicherungssuchdienst
wird beendet.
Error - 17.11.2011 04:04:51 | Computer Name = XXX | Source = Service Control Manager | ID = 7011
Description = Zeitüberschreitung (30000 ms) beim Warten auf eine Transaktionsrückmeldung
von Dienst NVSvc.
Error - 18.11.2011 03:55:33 | Computer Name = XXX | Source = BROWSER | ID = 8032
Description = Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport
"\Device\NetBT_Tcpip_{288E2EC4-6E71-4BD1-8B6F-4694131A4979}" zu oft fehl. Der Sicherungssuchdienst
wird beendet.
Error - 21.11.2011 04:12:35 | Computer Name = XXX | Source = BROWSER | ID = 8032
Description = Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport
"\Device\NetBT_Tcpip_{288E2EC4-6E71-4BD1-8B6F-4694131A4979}" zu oft fehl. Der Sicherungssuchdienst
wird beendet.
Error - 21.11.2011 07:06:44 | Computer Name = XXX | Source = DCOM | ID = 10009
Description = DCOM konnte mit dem Computer "YYYserver" unter Verwendung eines
beliebigen, konfigurierten Protokolls keine Daten austauschen.
Error - 24.11.2011 04:14:04 | Computer Name = XXX | Source = BROWSER | ID = 8032
Description = Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport
"\Device\NetBT_Tcpip_{288E2EC4-6E71-4BD1-8B6F-4694131A4979}" zu oft fehl. Der Sicherungssuchdienst
wird beendet.
< End of report >
Etwas anderes habe ich bisher noch nicht gemacht ( nicht -> defogger und auch keinen Virenscan, da Web.de geschrieben hat, dass Zeus schwer zu finden ist). Falls notwendig hole ich das noch nach. Vielen Dank schon mal im Voraus. |
| Themen zu Zeus Virus laut web.de |
| 0x00000001, 32 bit, 4d36e972-e325-11ce-bfc1-08002be10318, askbar, bho, bonjour, c:\windows\system32\rundll32.exe, computer, defender, desktop, e-mail, einstellungen, email, encrypt, error, firefox, flash player, helper.exe, logfile, monitor, mozilla, msvcrt, nt.dll, plug-in, registry, remote control, rundll, scan, security, sehr geholfen, server, shortcut, sicherheit, sicherheitsexperten, tracker, trojaner, trojaner board, udp, virus, windows internet |
Baum-Darstellung