| |
| |||||||
Log-Analyse und Auswertung: Winows XP - Computer gesperrtWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
23.12.2011, 16:40
| #1 |
 |  Winows XP - Computer gesperrt Hallo liebe Leute von trojaner-board.de, ich hatte mir vor etwa 3 Wochen den Gema-Virus eingefangen, ihn aber mit der Kaspersky-Rescue-CD in den Griff bekommen, so dass ich wieder arbeiten konnte. Nun ist mein Rechner schon wieder gesperrt, wegen angeblicher pornografischer Inhalte. Ich soll bezahlen und upgraden, das Übliche halt. Ich habe daher die Kaspersky-Rescue-CD noch mal eingelegt, upgedatet und laufen lassen. Es wurde auch etwas gefunden und entfernt, der Rechner ist aber nach dem Hochfahren nach wenigen Sekunden wieder gesperrt. Bei Google habe ich keine Hilfe gefunden, außer euer Forum. Könnt ihr mir helfen? Die Sache brennt natürlich, da ich zwischen den Feiertagen ein Projekt abschliessen wollte. Im Anhang die nötigen Log-files (defogger, OTL, extras, gmer). Vielen Dank im Voraus und frohe Feiertage. defogger_disable by jpshortstuff (23.02.10.1) Log created at 12:23 on 23/12/2011 (SW) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers... -=E.O.F=- --- --- --- OTL Logfile: OTL EXTRAS Logfile: Code:
ATTFilter OTL logfile created on: 23.12.2011 12:34:42 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\SW\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,25 Gb Total Physical Memory | 2,87 Gb Available Physical Memory | 88,29% Memory free 5,09 Gb Paging File | 4,92 Gb Available in Paging File | 96,53% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 294,11 Gb Total Space | 278,67 Gb Free Space | 94,75% Space Free | Partition Type: NTFS Drive D: | 637,40 Gb Total Space | 104,13 Gb Free Space | 16,34% Space Free | Partition Type: NTFS Drive E: | 931,51 Gb Total Space | 476,45 Gb Free Space | 51,15% Space Free | Partition Type: NTFS Drive G: | 931,51 Gb Total Space | 63,80 Gb Free Space | 6,85% Space Free | Partition Type: NTFS Drive H: | 14,92 Gb Total Space | 14,92 Gb Free Space | 100,00% Space Free | Partition Type: FAT32 Drive Z: | 209,10 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: HAL9000 | User Name: SW | Logged in as Administrator. Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2011.12.23 12:14:09 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\SW\Desktop\OTL.exe PRC - [2011.11.08 19:41:40 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Programme\Mozilla Firefox\firefox.exe PRC - [2008.04.14 06:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe ========== Modules (No Company Name) ========== MOD - [2011.11.08 21:46:02 | 000,093,696 | ---- | M] () -- C:\Programme\FileZilla FTP Client\fzshellext.dll MOD - [2011.11.08 19:41:39 | 001,989,592 | ---- | M] () -- C:\Programme\Mozilla Firefox\mozjs.dll MOD - [2010.11.10 11:49:38 | 000,301,056 | ---- | M] () -- C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU MOD - [2009.11.16 20:31:58 | 000,069,632 | ---- | M] () -- C:\Programme\PSPad editor\PSPadShell.dll MOD - [2007.06.02 20:41:36 | 000,617,472 | ---- | M] () -- C:\Programme\IZArc\IZArcCM.dll ========== Win32 Services (SafeList) ========== SRV - [2011.09.10 12:21:29 | 000,068,096 | ---- | M] () [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe -- (Macromedia Licensing Service) SRV - [2011.06.28 17:54:51 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.06.06 16:50:09 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010.02.19 12:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2009.07.09 20:43:38 | 001,830,856 | ---- | M] (UltraVNC) [Auto | Stopped] -- C:\Programme\UltraVNC\WinVNC.exe -- (uvnc_service) SRV - [2007.08.03 11:51:18 | 000,382,248 | ---- | M] (Nero AG) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - [2007.01.09 16:16:12 | 000,061,440 | ---- | M] (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) [Auto | Stopped] -- C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe -- (MZCCntrl) SRV - [2005.04.27 13:59:24 | 000,241,725 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\UPHClean\uphclean.exe -- (UPHClean) SRV - [2005.04.03 23:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT) SRV - [2003.07.28 11:28:22 | 000,089,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - [2011.06.28 17:54:52 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb) DRV - [2011.06.28 17:54:52 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2010.08.27 13:23:08 | 000,019,200 | ---- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyx.sys -- (MTOnlPktAlyX) DRV - [2010.05.05 03:45:04 | 004,807,680 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2009.05.11 10:49:19 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\Programme\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2009.05.11 08:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.04.11 18:11:46 | 000,010,688 | ---- | M] (UVNC BVBA) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mv2.sys -- (mv2) DRV - [2008.05.23 14:51:02 | 000,024,624 | R--- | M] (Hewlett-Packard Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\hpdskflt.sys -- (hpdskflt) DRV - [2008.04.13 23:23:10 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm) DRV - [2007.09.13 14:54:14 | 000,012,416 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\asusgsb.sys -- (asusgsb) DRV - [2007.09.13 14:54:12 | 000,012,288 | ---- | M] (ASUSTeK Computer Inc.) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\EIO.sys -- (EIO) DRV - [2007.06.18 16:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr) DRV - [2007.04.16 15:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM) DRV - [2007.04.04 20:16:20 | 000,041,216 | R--- | M] (Infineon Technologies AG) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ifxtpm.sys -- (IFXTPM) DRV - [2007.03.26 12:21:06 | 004,395,008 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2006.12.28 17:44:44 | 000,084,992 | R--- | M] (ATI Research Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AtiHdAud.sys -- (HdAudAddService) DRV - [2006.10.09 14:03:56 | 000,017,152 | ---- | M] (Deutsche Telekom AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Marmiko Shared\MInfraIS\MIINPazx.sys -- (MIINPazX) DRV - [2006.10.04 08:14:26 | 000,017,280 | ---- | M] (Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Stopped] -- C:\Programme\Gemeinsame Dateien\Marmiko Shared\MAcNdis5.sys -- (MACNDIS5) DRV - [2006.08.15 06:09:48 | 000,083,200 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp) DRV - [2004.08.13 03:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor) DRV - [2001.08.18 03:20:12 | 000,097,440 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k) Broadcom NetLink (TM) DRV - [2001.08.17 11:11:18 | 000,020,160 | ---- | M] (ADMtek Incorporated) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ADM8511.SYS -- (ADM8511) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "LEO Eng-Deu" FF - prefs.js..browser.search.update: false FF - prefs.js..browser.startup.homepage: "about:blank" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25 FF - prefs.js..extensions.enabledItems: turntoolviewer@turntool.com:2.9.5.9 FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.7.3 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Programme\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.9: C:\Programme\VideoLAN\VLC\npvlc.dll (the VideoLAN Team) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Programme\Mozilla Firefox\components [2011.11.08 19:41:41 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2011.09.14 19:49:33 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.0.4\extensions\\Components: D:\Email\App\thunderbird\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.0.4\extensions\\Plugins: D:\Email\App\thunderbird\plugins [2011.06.06 22:18:01 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\Mozilla\Extensions [2011.11.07 19:27:34 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\Mozilla\Firefox\Profiles\gbnxp3az.default\extensions [2011.08.10 21:03:55 | 000,000,000 | ---D | M] ("TurnTool Viewer") -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\Mozilla\Firefox\Profiles\gbnxp3az.default\extensions\turntoolviewer@turntool.com [2011.11.08 19:41:43 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions () (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\SW\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\GBNXP3AZ.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI [2011.11.08 19:41:40 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll [2011.06.06 15:21:53 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\mozilla firefox\plugins\npdeployJava1.dll [2011.10.22 11:28:39 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.10.22 11:28:39 | 000,002,252 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml [2011.10.22 11:28:39 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml [2011.10.22 11:28:39 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml [2011.10.22 11:28:39 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml [2011.10.22 11:28:39 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2011.01.27 14:00:57 | 000,001,211 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 3dns.adobe.com 3dns-1.adobe.com 3dns-2.adobe.com 3dns-3.adobe.com 3dns-4.adobe.com activate.adobe.com activate-sea.adobe.com activate-sjc0.adobe.com activate.wip.adobe.com O1 - Hosts: 127.0.0.1 activate.wip1.adobe.com activate.wip2.adobe.com activate.wip3.adobe.com activate.wip4.adobe.com adobe-dns.adobe.com adobe-dns-1.adobe.com adobe-dns-2.adobe.com adobe-dns-3.adobe.com adobe-dns-4.adobe.com O1 - Hosts: 127.0.0.1 adobeereg.com practivate.adobe practivate.adobe.com practivate.adobe.newoa practivate.adobe.ntp practivate.adobe.ipp ereg.adobe.com ereg.wip.adobe.com ereg.wip1.adobe.com O1 - Hosts: 127.0.0.1 ereg.wip2.adobe.com ereg.wip3.adobe.com ereg.wip4.adobe.com hl2rcv.adobe.com wip.adobe.com wip1.adobe.com wip2.adobe.com wip3.adobe.com wip4.adobe.com O1 - Hosts: 127.0.0.1 www.adobeereg.com wwis-dubc1-vip60.adobe.com www.wip.adobe.com www.wip1.adobe.com O1 - Hosts: 127.0.0.1 www.wip2.adobe.com www.wip3.adobe.com www.wip4.adobe.com wwis-dubc1-vip60.adobe.com crl.verisign.net CRL.VERISIGN.NET ood.opsource.net O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Programme\Gemeinsame Dateien\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Programme\Gemeinsame Dateien\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found O4 - HKLM..\Run: [avgnt] C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [CanonMyPrinter] C:\Programme\Canon\MyPrinter\BJMyPrt.exe (CANON INC.) O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de) O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found O4 - HKLM..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [SwitchBoard] C:\Programme\Gemeinsame Dateien\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated) O4 - HKCU..\Run: [AdobeBridge] File not found O4 - HKCU..\Run: [opera.exe] C:\Dokumente und Einstellungen\SW\Anwendungsdaten\Opera\Opera\opera.exe () O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyPictures = 01 00 00 00 [binary data] O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyDocs = 01 00 00 00 [binary data] O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoNetworkConnections = [binary data] O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSharedDocuments = 01 00 00 00 [binary data] O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 00 F8 FF 01 [binary data] O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = F0 FF FF 01 [binary data] O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableTaskMgr = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1 O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{17137C69-AC1F-4951-B518-D25AE03701F7}: DhcpNameServer = 10.1.222.222 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3E878A5F-19D4-4A2A-9716-90CB4701AF56}: DhcpNameServer = 10.1.222.222 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{91C7907B-C592-474D-B2B3-596FED9F050D}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{92ED2C2D-0401-416D-9233-7760742F38FF}: DhcpNameServer = 10.1.222.222 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - HKCU Winlogon: Shell - (explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - File not found O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O32 - HKLM CDRom: AutoRun - 0 O32 - AutoRun File - [2009.09.29 15:01:15 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.12.23 12:25:26 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\SW\Recent [2011.12.23 12:14:09 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Dokumente und Einstellungen\SW\Desktop\OTL.exe [2011.12.22 23:56:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\Opera [2011.12.16 23:18:03 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\Google [2011.12.16 23:16:40 | 000,000,000 | ---D | C] -- C:\Programme\Google [2011.12.16 23:16:40 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\SW\Lokale Einstellungen\Anwendungsdaten\Google [2011.12.14 16:08:14 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\CD-LabelPrint [2011.12.13 21:57:19 | 000,000,000 | ---D | C] -- C:\Programme\AudioConverter Studio [2011.12.10 11:52:30 | 000,000,000 | ---D | C] -- C:\Programme\PSPad editor [2011.12.09 19:56:53 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0 [2011.11.30 20:15:00 | 000,000,000 | ---D | C] -- C:\Programme\Tools&More [2011.11.23 19:18:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\SW\Lokale Einstellungen\Anwendungsdaten\Help [2011.11.23 19:18:45 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\Help [2011.11.23 19:06:10 | 000,000,000 | ---D | C] -- C:\Programme\Audiograbber ========== Files - Modified Within 30 Days ========== [2011.12.23 12:31:13 | 000,448,470 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2011.12.23 12:31:13 | 000,432,356 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2011.12.23 12:31:13 | 000,079,910 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2011.12.23 12:31:13 | 000,067,312 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2011.12.23 12:26:52 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011.12.23 12:23:56 | 000,000,000 | ---- | M] () -- C:\Dokumente und Einstellungen\SW\defogger_reenable [2011.12.23 12:16:59 | 000,302,592 | ---- | M] () -- C:\Dokumente und Einstellungen\SW\Desktop\0ed325wx.exe [2011.12.23 12:14:09 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Dokumente und Einstellungen\SW\Desktop\OTL.exe [2011.12.23 12:13:38 | 000,050,477 | ---- | M] () -- C:\Dokumente und Einstellungen\SW\Desktop\Defogger.exe [2011.12.22 14:24:50 | 000,019,544 | ---- | M] () -- C:\Dokumente und Einstellungen\SW\Desktop\Lehrplan2008.rtf [2011.12.21 15:30:23 | 000,051,131 | ---- | M] () -- C:\Dokumente und Einstellungen\SW\Desktop\michtitten2.JPG [2011.12.21 00:15:37 | 000,002,278 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011.12.16 23:16:44 | 000,001,078 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2011.12.16 00:08:10 | 001,453,712 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011.12.14 23:38:24 | 000,026,112 | ---- | M] () -- C:\Dokumente und Einstellungen\SW\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.12.13 21:07:31 | 000,000,034 | ---- | M] () -- C:\WINDOWS\cdplayer.ini [2011.12.13 21:01:27 | 000,000,049 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2011.12.11 23:14:24 | 000,000,435 | ---- | M] () -- C:\Dokumente und Einstellungen\SW\Desktop\XMAS2011CD.lnk [2011.12.10 12:11:31 | 000,001,024 | ---- | M] () -- C:\Dokumente und Einstellungen\SW\Desktop\index.php [2011.12.08 16:52:12 | 000,001,255 | ---- | M] () -- C:\Dokumente und Einstellungen\SW\Desktop\SOUNDS.lnk [2011.12.02 14:12:08 | 000,000,579 | ---- | M] () -- C:\Dokumente und Einstellungen\SW\Desktop\BLA_LIVE.lnk ========== Files Created - No Company Name ========== [2011.12.23 12:23:56 | 000,000,000 | ---- | C] () -- C:\Dokumente und Einstellungen\SW\defogger_reenable [2011.12.23 12:16:59 | 000,302,592 | ---- | C] () -- C:\Dokumente und Einstellungen\SW\Desktop\0ed325wx.exe [2011.12.23 12:13:38 | 000,050,477 | ---- | C] () -- C:\Dokumente und Einstellungen\SW\Desktop\Defogger.exe [2011.12.22 14:24:49 | 000,019,544 | ---- | C] () -- C:\Dokumente und Einstellungen\SW\Desktop\Lehrplan2008.rtf [2011.12.21 15:30:23 | 000,051,131 | ---- | C] () -- C:\Dokumente und Einstellungen\SW\Desktop\michtitten2.JPG [2011.12.16 23:16:44 | 000,001,078 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2011.12.11 23:14:24 | 000,000,435 | ---- | C] () -- C:\Dokumente und Einstellungen\SW\Desktop\XMAS2011CD.lnk [2011.12.10 11:53:18 | 000,001,024 | ---- | C] () -- C:\Dokumente und Einstellungen\SW\Desktop\index.php [2011.12.08 16:50:57 | 000,001,255 | ---- | C] () -- C:\Dokumente und Einstellungen\SW\Desktop\SOUNDS.lnk [2011.12.02 14:12:12 | 000,000,579 | ---- | C] () -- C:\Dokumente und Einstellungen\SW\Desktop\BLA_LIVE.lnk [2011.11.23 19:20:36 | 000,000,034 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2011.09.13 09:27:49 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\AVSredirect.dll [2011.06.17 22:07:28 | 000,000,049 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2011.06.14 21:10:55 | 000,000,044 | ---- | C] () -- C:\WINDOWS\HBUser.ini [2011.06.12 23:17:33 | 000,026,112 | ---- | C] () -- C:\Dokumente und Einstellungen\SW\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011.06.06 21:55:54 | 000,294,912 | ---- | C] () -- C:\WINDOWS\System32\ATIODE.exe [2011.06.06 21:55:54 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ATIODCLI.exe [2011.06.06 14:07:43 | 000,049,152 | R--- | C] () -- C:\WINDOWS\System32\ChCfg.exe [2011.06.06 12:22:36 | 000,021,907 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini [2011.06.06 12:22:23 | 000,021,590 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2011.06.06 12:22:10 | 000,010,288 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2011.06.06 10:34:07 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys [2010.05.13 14:54:21 | 000,000,608 | -HS- | C] () -- C:\WINDOWS\System32\winzvprt5.sys [2010.05.12 14:45:44 | 000,000,160 | ---- | C] () -- C:\WINDOWS\System32\AddPort.ini [2010.05.12 14:44:44 | 000,000,683 | ---- | C] () -- C:\WINDOWS\hpntwksetup.ini [2010.02.28 13:20:32 | 000,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI [2010.02.28 13:08:09 | 000,262,144 | ---- | C] () -- C:\WINDOWS\System32\default_user_class.dat [2009.10.01 22:34:59 | 000,000,400 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009.09.29 23:48:40 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll [2009.09.29 23:48:40 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe [2009.09.29 20:44:23 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2009.09.29 16:04:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin [2009.09.29 15:58:32 | 000,000,004 | ---- | C] () -- C:\WINDOWS\HBCIKRNL.INI [2009.09.29 15:51:28 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat [2009.09.29 15:51:27 | 003,107,788 | R--- | C] () -- C:\WINDOWS\System32\ativvaxx.dat [2009.09.29 15:51:27 | 000,203,331 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat [2009.09.29 15:51:27 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat [2009.09.29 15:46:55 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2009.09.29 15:45:32 | 001,453,712 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009.09.29 15:03:57 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2009.09.29 14:57:44 | 000,021,740 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2006.02.28 12:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2006.02.28 12:00:00 | 000,448,470 | ---- | C] () -- C:\WINDOWS\System32\perfh007.dat [2006.02.28 12:00:00 | 000,432,356 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2006.02.28 12:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2006.02.28 12:00:00 | 000,269,480 | ---- | C] () -- C:\WINDOWS\System32\perfi007.dat [2006.02.28 12:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2006.02.28 12:00:00 | 000,079,910 | ---- | C] () -- C:\WINDOWS\System32\perfc007.dat [2006.02.28 12:00:00 | 000,067,312 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2006.02.28 12:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2006.02.28 12:00:00 | 000,034,478 | ---- | C] () -- C:\WINDOWS\System32\perfd007.dat [2006.02.28 12:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2006.02.28 12:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2006.02.28 12:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2006.02.28 12:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2003.02.20 16:53:42 | 000,005,702 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [2002.10.15 23:54:04 | 000,153,088 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2002.10.06 19:42:58 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll [2002.10.05 00:04:26 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\VorbisEnc.dll [2002.10.05 00:04:26 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll [2002.10.05 00:04:18 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll [2002.05.28 18:55:42 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2002.05.28 18:54:40 | 000,004,605 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2002.05.16 01:38:40 | 000,091,136 | ---- | C] () -- C:\WINDOWS\System32\mp4fil32.dll [2002.05.04 15:19:00 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\avisynthEx.dll [2002.04.19 16:23:26 | 000,106,137 | ---- | C] () -- C:\WINDOWS\System32\libpostproc.dll [2002.04.19 15:51:04 | 000,211,760 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2001.07.07 03:00:00 | 000,003,254 | ---- | C] () -- C:\WINDOWS\System32\HPTCPMON.INI [2001.06.22 13:06:02 | 000,167,936 | ---- | C] () -- C:\WINDOWS\System32\MPEG2DEC.dll ========== LOP Check ========== [2011.07.11 20:29:43 | 000,000,000 | -H-D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonBJ [2011.07.11 20:30:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\CanonIJMSetup [2011.06.14 20:41:47 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\regid.1986-12.com.adobe [2011.08.24 06:53:04 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\T-Online [2011.09.10 12:02:26 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP [2011.06.16 21:20:46 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\AMPSoft [2011.12.21 15:39:30 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\BitTorrent [2011.11.20 11:21:40 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\BSplayer [2011.06.12 19:20:24 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\BSplayer Pro [2011.12.14 16:08:14 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\CD-LabelPrint [2011.11.06 11:52:07 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\DVDVideoSoft [2011.12.12 18:22:50 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\FileZilla [2011.06.07 01:25:21 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\InfraRecorder [2011.12.22 23:56:05 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\Opera [2011.06.12 10:28:29 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen\SW\Anwendungsdaten\T-Online ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.06.06 21:54:24 | 000,000,000 | ---D | M] -- C:\ATI [2011.12.12 19:06:41 | 000,000,000 | ---D | M] -- C:\Dokumente und Einstellungen [2011.12.23 11:04:28 | 000,000,000 | ---D | M] -- C:\Kaspersky Rescue Disk 10.0 [2011.11.05 00:46:05 | 000,000,000 | ---D | M] -- C:\Program Files [2011.12.16 23:16:40 | 000,000,000 | ---D | M] -- C:\Programme [2011.06.06 22:17:45 | 000,000,000 | -HSD | M] -- C:\RECYCLER [2009.09.29 15:15:05 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2011.12.23 11:54:40 | 000,000,000 | ---D | M] -- C:\TMP [2011.12.23 11:58:10 | 000,000,000 | ---D | M] -- C:\WINDOWS < %PROGRAMFILES%\*.exe > Invalid Environment Variable: LOCALAPPDATA < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > < MD5 for: AFD.SYS > [2008.04.13 23:49:24 | 000,138,112 | ---- | M] (Microsoft Corporation) MD5=322D0E36693D6E24A2398BEE62A268CD -- C:\WINDOWS\ServicePackFiles\i386\afd.sys [2008.08.14 11:04:36 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=7E775010EF291DA96AD17CA4B17137D7 -- C:\WINDOWS\system32\dllcache\afd.sys [2008.08.14 11:04:36 | 000,138,496 | ---- | M] (Microsoft Corporation) MD5=7E775010EF291DA96AD17CA4B17137D7 -- C:\WINDOWS\system32\drivers\afd.sys < MD5 for: EXPLORER.EXE > [2008.04.14 06:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\explorer.exe [2008.04.14 06:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) MD5=418045A93CD87A352098AB7DABE1B53E -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe < MD5 for: IPSEC.SYS > [2008.04.13 23:49:44 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=23C74D75E36E7158768DD63D92789A91 -- C:\WINDOWS\ServicePackFiles\i386\ipsec.sys [2008.04.13 23:49:44 | 000,075,264 | ---- | M] (Microsoft Corporation) MD5=23C74D75E36E7158768DD63D92789A91 -- C:\WINDOWS\system32\drivers\ipsec.sys < MD5 for: REGEDIT.EXE > [2008.04.14 06:53:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\regedit.exe [2008.04.14 06:53:00 | 000,153,600 | ---- | M] (Microsoft Corporation) MD5=AD9226BF3CED13636083BB9C76E9D2A2 -- C:\WINDOWS\ServicePackFiles\i386\regedit.exe < MD5 for: USERINIT.EXE > [2008.04.14 06:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe [2008.04.14 06:53:04 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=788F95312E26389D596C0FA55834E106 -- C:\WINDOWS\system32\userinit.exe < MD5 for: WINLOGON.EXE > [2011.06.06 11:57:49 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=63F596358D91E0DE887E3D031CCCF5C6 -- C:\WINDOWS\system32\winlogon.exe [2008.04.14 06:53:06 | 000,513,024 | ---- | M] (Microsoft Corporation) MD5=F09A527B422E25C478E38CAA0E44417A -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Kmode: %SystemRoot%\system32\win32k.sys [2009.04.19 20:46:19 | 001,847,296 | ---- | M] (Microsoft Corporation) HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > < End of report > --- --- --- OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 23.12.2011 12:34:42 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Dokumente und Einstellungen\SW\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,25 Gb Total Physical Memory | 2,87 Gb Available Physical Memory | 88,29% Memory free
5,09 Gb Paging File | 4,92 Gb Available in Paging File | 96,53% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 294,11 Gb Total Space | 278,67 Gb Free Space | 94,75% Space Free | Partition Type: NTFS
Drive D: | 637,40 Gb Total Space | 104,13 Gb Free Space | 16,34% Space Free | Partition Type: NTFS
Drive E: | 931,51 Gb Total Space | 476,45 Gb Free Space | 51,15% Space Free | Partition Type: NTFS
Drive G: | 931,51 Gb Total Space | 63,80 Gb Free Space | 6,85% Space Free | Partition Type: NTFS
Drive H: | 14,92 Gb Total Space | 14,92 Gb Free Space | 100,00% Space Free | Partition Type: FAT32
Drive Z: | 209,10 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: HAL9000 | User Name: SW | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Programme\Adobe Illustrator CS5\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OpenNew] -- cmd.exe /k cd %1 (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5900:TCP" = 5900:TCP:*:Enabled:vnc5900
"5800:TCP" = 5800:TCP:*:Enabled:vnc5800
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Programme\UltraVNC\vncviewer.exe" = C:\Programme\UltraVNC\vncviewer.exe:*:Enabled:vncviewer.exe -- (UltraVNC)
"C:\Dokumente und Einstellungen\LSS\Desktop\wwwloc_WINPREP\wwwloc.exe" = C:\Dokumente und Einstellungen\LSS\Desktop\wwwloc_WINPREP\wwwloc.exe:*:Enabled:wwwloc
"D:\PC_Service\wwwloc_WINPREP\wwwloc.exe" = D:\PC_Service\wwwloc_WINPREP\wwwloc.exe:*:Enabled:wwwloc
"C:\Programme\BitTorrent\BitTorrent.exe" = C:\Programme\BitTorrent\BitTorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.)
"C:\Programme\Java\jre6\launch4j-tmp\jukes-4.3.8.54.exe" = C:\Programme\Java\jre6\launch4j-tmp\jukes-4.3.8.54.exe:*:Disabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Dokumente und Einstellungen\SW\Desktop\VideoToMp3Setup.exe" = C:\Dokumente und Einstellungen\SW\Desktop\VideoToMp3Setup.exe:*:Enabled:InstallCore™
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5200_series" = Canon MG5200 series MP Drivers
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{23767F5D-A80C-4264-B8EA-ED4085FC332A}" = Adobe Illustrator CS5.1
"{26A24AE4-039D-4CA4-87B4-2F83216025FF}" = Java(TM) 6 Update 25
"{2934DCB0-F8EE-11E0-A4A5-B8AC6F97B88E}" = Google Earth Plug-in
"{295C31E5-3F91-498E-9623-DA24D2FA2B6A}" = T-Online WLAN-Access Finder
"{2F353D44-73BB-4971-B31D-F7642E9E9531}" = Macromedia Flash MX 2004
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help
"{37AF26EB-ACCD-4F9C-A13E-81483F932203}" = Catalyst Control Center - Branding
"{3AEED9A8-DED2-4A70-859C-EBB358E945FE}" = e-Coolector
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{8AEA4BE2-2B52-41C0-BB7D-9F2D17AF1031}" = Nero 8
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{90AF0407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office PowerPoint Viewer 2003
"{91130407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Basic Edition 2003
"{9158FF30-78D7-40EF-B83E-451AC5334640}" = Adobe Photoshop CS5.1
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{97C82B44-D408-4F14-9252-47FC1636D23E}_is1" = IZArc 3.81
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9DE3F260-B88E-42CE-90E7-73C78C37D95E}" = 32 Bit HP BiDi Channel Components Installer
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AA0000000001}" = Adobe Reader X - Deutsch
"{AEB9948B-4FF2-47C9-990E-47014492A0FE}" = MSXML 6.0 Parser
"{B1275E23-717A-4D52-997A-1AD1E24BC7F3}" = T-Online 6.0
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C7793EE8-F666-4E6B-9827-76468679480E}" = Tweakui Powertoy for Windows XP
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{F0207194-35B9-4476-B02E-395EE52B5960}" = ASUS nVidia Driver
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FF77941A-2BFA-4A18-BE2E-69B9498E4D55}" = User Profile Hive Cleanup Service
"3B18191663CDFABAA2A93D4267E54D683153FF60" = Windows-Treiberpaket - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"All ATI Software" = ATI - Dienstprogramm zur Deinstallation der Software
"AMP Font Viewer" = AMP Font Viewer
"AudioConverter Studio_is1" = AudioConverter Studio 6.2
"Audiograbber" = Audiograbber 1.83 SE
"Audiograbber-Lame" = Audiograbber MP3-Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BitTorrent" = BitTorrent
"BSPlayerf" = BS.Player FREE
"Canon MG5200 series Benutzerregistrierung" = Canon MG5200 series Benutzerregistrierung
"CanonMyPrinter" = Canon My Printer
"CCleaner" = CCleaner
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"DVDx 4.0 Open Edition" = DVDx 4.0 Open Edition
"FileZilla Client" = FileZilla Client 3.5.2
"Free Video to MP3 Converter_is1" = Free Video to MP3 Converter version 4.3.3.920
"FreePDF_XP" = FreePDF XP (Remove only)
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InfraRecorder" = InfraRecorder
"KaloMa_is1" = KaloMa 4.72
"MediaNavigation.CDLabelPrint" = CD-LabelPrint
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 8.0 (x86 de)" = Mozilla Firefox 8.0 (x86 de)
"Native Instruments Battery VSTi DXi RTAS v2.1.5 Incl Keygen" = Native Instruments Battery VSTi DXi RTAS v2.1.5 Incl Keygen
"NimoCorp" = Nimo Codecs Pack v5.0 (Remove Only)
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"PSPad editor_is1" = PSPad editor
"qt7lite_is1" = QT Lite 2.8.0
"Redirection Port Monitor" = RedMon - Redirection Port Monitor
"Ultravnc2_is1" = UltraVNC 1.0.6.4
"VLC media player" = VLC media player 1.1.9
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"WMFDist11" = Windows Media Format 11 runtime
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"xvid" = XviD MPEG-4 Video Codec
========== Last 10 Event Log Errors ==========
[ System Events ]
Error - 23.12.2011 03:27:07 | Computer Name = HAL9000 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Treiber für parallelen Anschluss" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1058
Error - 23.12.2011 06:55:19 | Computer Name = HAL9000 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Treiber für parallelen Anschluss" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1058
Error - 23.12.2011 06:58:44 | Computer Name = HAL9000 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {1BE1F766-5536-11D1-B726-00C04FB926AF}
Error - 23.12.2011 06:59:52 | Computer Name = HAL9000 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AmdPPM avgio avipbb EIO Fips ssmdrv
Error - 23.12.2011 07:09:57 | Computer Name = HAL9000 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1058" aufgetreten, als der Dienst "helpsvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {833E4010-AFF7-4AC3-AAC2-9F24C1457BCE}
Error - 23.12.2011 07:25:26 | Computer Name = HAL9000 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {1BE1F766-5536-11D1-B726-00C04FB926AF}
Error - 23.12.2011 07:27:24 | Computer Name = HAL9000 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {1BE1F766-5536-11D1-B726-00C04FB926AF}
Error - 23.12.2011 07:27:38 | Computer Name = HAL9000 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
Error - 23.12.2011 07:28:31 | Computer Name = HAL9000 | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AmdPPM avgio avipbb EIO Fips ssmdrv
Error - 23.12.2011 07:32:53 | Computer Name = HAL9000 | Source = DCOM | ID = 10005
Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"
mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
< End of report >
--- --- --- GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2011-12-23 16:04:20
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 ST31000528AS rev.CC37
Running: 0ed325wx.exe; Driver: C:\DOKUME~1\SW\LOKALE~1\Temp\fwldipoc.sys
---- Disk sectors - GMER 1.0.15 ----
Disk \Device\Harddisk0\DR0 malicious Win32:MBRoot code @ sector 1953520068
Disk \Device\Harddisk0\DR0 PE file @ sector 1953520090
---- EOF - GMER 1.0.15 ----
--- --- --- Geändert von mr.t-bird (23.12.2011 um 16:55 Uhr) |
| Themen zu Winows XP - Computer gesperrt |
| 0x00000001, 32 bit, anhang, arbeiten, benutzerregistrierung, brennt, computer, disabletaskmgr, eingefangen, eingelegt, entfernt, frohe, gen, gesperrt, gmer, google, google earth, griff, hochfahren, laufen, leute, malicious win32:mbroot code, mozilla thunderbird, natürlich, nodrives, plug-in, projekt, rechner, required, sache, sched.exe, sekunden, torrent.exe, upgrade, virus, win32k.sys, windows internet, windows xp, winows xp, woche, wochen |
Baum-Darstellung